Standards

ERC-777 Hooks

ERC-777 hooks are callback functions that can run during token transfers, giving sender or recipient contracts a chance to execute code.

A token transfer can call into another contract while the transfer is happening.

ERC-777 Hooks Explained in Detail

ERC-777 allows hook functions such as tokensToSend and tokensReceived to run during token transfers. The ERC-1820 registry is used to discover hook implementers.

That means token movement can include external control flow. Code that looks like a simple token transfer may call attacker-controlled logic before the surrounding function finishes.

Smart contract example

function deposit(uint256 amount) external {
    token.transferFrom(msg.sender, address(this), amount);
    balances[msg.sender] += amount;
}

If the token invokes a recipient or sender hook, external code may run before balances[msg.sender] is updated.

ERC-777 Hooks in Auditing

ERC-777 hooks are a common reason auditors avoid the shortcut "token transfers cannot reenter." Some ERC-20-like tokens and token standards can trigger callbacks or other external effects.

Auditors review token transfers as external calls, especially when state updates happen after transfers or when the token list is not tightly controlled.

Red flags in code

  • State updates happen after token transfers.

  • The protocol assumes all supported tokens behave like plain ERC-20 tokens.

  • Reentrancy protection covers one function but not related cross-function paths.

  • Hooks can call back into deposit, withdraw, claim, swap, or liquidation flows.

  • Token acceptance logic ignores ERC-1820 hook registration.

How to test or review it

  • Test with a malicious token or hook receiver that reenters during transfer.

  • Apply checks-effects-interactions to token movement, not only Ether transfers.

  • Review reentrancy guard coverage across related functions.

  • Confirm unsupported hook-capable tokens are rejected or safely handled.

  • Combine hook tests with non-standard ERC-20 integration tests.

Sources