A curated collection of vulnerabilities and non-standard implementations in ERC20 token smart contracts.
Awesome Buggy ERC20 Tokens is a curated collection and analysis of vulnerabilities, bugs, and specification violations found in real-world ERC20 token smart contracts on the Ethereum blockchain. It documents issues like integer overflows, access control flaws, and non-standard implementations that have led to financial losses and ecosystem problems. The project serves as a reference to help developers avoid common pitfalls and build more secure tokens.
Smart contract developers, security researchers, DApp builders, cryptocurrency exchanges, and blockchain auditors who need to understand ERC20 contract risks. It's particularly valuable for those writing or auditing token contracts.
It provides a unique, crowdsourced database of real-world ERC20 contract failures that isn't available elsewhere, offering concrete examples rather than just theoretical best practices. Developers choose it to learn from actual deployed contract mistakes and to check if specific tokens have known issues.
A Collection of Vulnerabilities in ERC20 Smart Contracts With Tokens Affected
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Documents specific incidents like the BEC and SMT hacks with token addresses, providing concrete examples from deployed contracts for practical learning.
Includes detailed descriptions in ERC20_token_issue_list.md covering vulnerabilities from integer overflows to non-standard implementations, based on community analysis.
Encourages contributions via pull requests and has a Gitter channel, fostering collaborative maintenance and expansion of the dataset.
Provides Python scripts like gen_list_from_raw.py to generate and update token lists in CSV and JSON formats, streamlining data management.
Recent updates in the README stop at 2018, missing newer ERC20 vulnerabilities and tokens, which reduces its relevance for current security assessments.
The README admits data 'might not be perfectly accurate' and relies on public resources with script-generated analysis, posing risks for users relying on it for critical decisions.
Adding new bugs requires updating multiple files and running scripts, as outlined in the contribution guide, which may deter casual contributors and slow updates.