Standards

ERC20 Return Value

ERC20 return value refers to the boolean returned by transfer, transferFrom, and approve, and the real-world problem that some tokens return false or no data.

ERC20 calls do not all fail the same way, so integrations must check token call results carefully.

ERC20 Return Value Explained in Detail

ERC20 transfer, transferFrom, and approve return bool. A normal implementation returns true on success. Some real tokens return false, revert, or return no data.

Integration code must handle these cases before updating protocol accounting.

Smart contract example

bool ok = token.transfer(to, amount);
require(ok, "transfer failed");

For broader token compatibility, protocols often use SafeERC20.

ERC20 Return Value in Auditing

Unchecked ERC20 return values can make a protocol believe tokens moved when they did not. That can break deposits, withdrawals, repayments, swaps, and rewards.

Auditors test token integrations with non-standard behavior.

Red flags in code

  • Return value from transfer or transferFrom is ignored.

  • Low-level call checks only success and ignores decoded return data.

  • Accounting updates before token movement is confirmed.

  • The protocol assumes every token reverts on failure.

  • Fee-on-transfer or rebasing behavior is ignored when exact received amount matters.

How to test or review it

  • Use mock tokens that return false, return no data, revert, and charge transfer fees.

  • Compare pre-transfer and post-transfer balances when needed.

  • Confirm protocol state changes only after confirmed token movement.

  • Review approve flows and allowance race behavior.

  • Prefer SafeERC20 wrappers for external token calls.

Unchecked Return Value

An unchecked return value bug happens when code ignores whether a low-level call or token operation succeeded.

SafeERC20

SafeERC20 is an OpenZeppelin library that wraps ERC-20 calls to handle tokens that revert, return false, or return no value.

Non-Standard ERC-20

A non-standard ERC-20 is a token that behaves differently from common ERC-20 assumptions, such as missing return values, fees, rebases, pauses, blacklists, or unusual decimals.

Practice this in real audit scenarios

Definitions help, but auditors need reps. SCH turns concepts like ERC20 Return Value into exploit labs, code review habits, and report-writing practice.

Start the free trial or see the full smart contract auditing course.

Sources