Standards

Non-Standard ERC-20

A non-standard ERC-20 is a token that behaves differently from common ERC-20 assumptions, such as missing return values, fees, rebases, pauses, blacklists, or unusual decimals.

The token looks like an ERC-20, but one of its behaviors does not match what your contract expects.

Non-Standard ERC-20 Explained in Detail

A non-standard ERC-20 is an ERC-20-like token that does not match the assumptions an integration makes. The token may omit return values, return false, revert on approval patterns, charge transfer fees, rebase balances, pause transfers, blacklist accounts, or use unexpected decimals.

The risk is not that every unusual token is malicious. The risk is that the integrating contract treats all token behavior as uniform.

Smart contract example

require(token.transferFrom(msg.sender, address(this), amount));
credits[msg.sender] += amount;

This can fail with tokens that do not return a boolean. It can also credit too much if the token is a fee-on-transfer token.

Non-Standard ERC-20 in Auditing

Token integrations are external calls plus economic assumptions. Auditors review whether the protocol supports a strict allowlist of assets, rejects incompatible behavior, or handles each behavior deliberately.

Using SafeERC20 addresses some call-result issues, but it does not solve fee accounting, rebases, blacklists, transfer hooks, or decimal normalization.

Red flags in code

  • The protocol accepts arbitrary user-selected tokens.

  • Transfer success is assumed without a wrapper or explicit return-value handling.

  • Deposits credit requested amounts instead of actual received amounts.

  • The code assumes every token has 18 decimals.

  • Pause, blacklist, max-transfer, or approval quirks are not considered.

How to test or review it

  • Test with mocks for no-return, false-return, fee-on-transfer, rebasing, paused, and blacklisted tokens.

  • Check whether unsupported tokens are blocked at onboarding.

  • Review unchecked return value findings together with accounting behavior.

  • Verify balance-delta accounting where exact receipt matters.

  • Document which token behaviors are supported, unsupported, or accepted as an integration risk.

Unchecked Return Value

An unchecked return value bug happens when code ignores whether a low-level call or token operation succeeded.

SafeERC20

SafeERC20 is an OpenZeppelin library that wraps ERC-20 calls to handle tokens that revert, return false, or return no value.

Fee-on-Transfer Token

A fee-on-transfer token deducts a fee during transfer, so the recipient receives less than the amount requested by the sender.

Unchecked Return Value Attacks

SWC-104 unchecked call return values let Solidity calls fail silently. Learn the bug pattern, real exploit cases, and SafeERC20 fixes.

Dos Attacks

See how this vulnerability appears in real smart contract audits.

Smart Contract Audit Checklist

Use this SCH tool to turn the concept into practical audit work.

Practice this in real audit scenarios

Definitions help, but auditors need reps. SCH turns concepts like Non-Standard ERC-20 into exploit labs, code review habits, and report-writing practice.

Start the free trial or see the full smart contract auditing course.

Sources