Standards

SafeERC20

SafeERC20 is an OpenZeppelin library that wraps ERC-20 calls to handle tokens that revert, return false, or return no value.

It makes ERC-20 transfer and approval calls less brittle, but it does not make every token integration economically safe.

SafeERC20 Explained in Detail

SafeERC20 is an OpenZeppelin library for calling ERC-20 functions more defensively. It handles tokens that revert, return false, or return no value where a standard interface might expect a boolean.

It is a call-safety wrapper. It is not a full token-integration risk model.

Smart contract example

using SafeERC20 for IERC20;

function deposit(uint256 amount) external {
    asset.safeTransferFrom(msg.sender, address(this), amount);
}

This is safer than ignoring a return value, but it still does not prove the contract received exactly amount.

SafeERC20 in Auditing

SafeERC20 reduces bugs around unchecked return values, but auditors still need to review token behavior and accounting. A safe transfer call can still interact with fee-on-transfer tokens, rebasing tokens, paused tokens, blacklists, hooks, and unusual decimals.

The wrapper should be treated as one layer in a token integration, not as a blanket guarantee.

Red flags in code

  • Raw transfer or transferFrom is used where SafeERC20 would be safer.

  • The code assumes safeTransferFrom means exactly amount arrived.

  • Approval flows ignore the ERC-20 approval race condition.

  • Token support is broad, but no non-standard ERC-20 behavior is tested.

  • Balance-delta checks are missing for assets where exact receipt matters.

How to test or review it

  • Verify all ERC-20 transfers and approvals use a consistent safe-call pattern.

  • Test tokens that return false, return no value, and revert.

  • Add fee-on-transfer and rebasing mocks to prove SafeERC20 is not being over-trusted.

  • Check approval changes with zero-first or force-approve patterns where needed.

  • Review call safety separately from economic accounting.

Unchecked Return Value

An unchecked return value bug happens when code ignores whether a low-level call or token operation succeeded.

Non-Standard ERC-20

A non-standard ERC-20 is a token that behaves differently from common ERC-20 assumptions, such as missing return values, fees, rebases, pauses, blacklists, or unusual decimals.

ERC-20 Approval Race Condition

The ERC-20 approval race condition is a token allowance issue where a spender can use an old allowance before a new allowance change takes effect.

Unchecked Return Value Attacks

SWC-104 unchecked call return values let Solidity calls fail silently. Learn the bug pattern, real exploit cases, and SafeERC20 fixes.

Smart Contract Audit Checklist

Use this SCH tool to turn the concept into practical audit work.

Practice this in real audit scenarios

Definitions help, but auditors need reps. SCH turns concepts like SafeERC20 into exploit labs, code review habits, and report-writing practice.

Start the free trial or see the full smart contract auditing course.

Sources