Smart Contract Security Glossary

ERC-4626 Vaults

ERC-4626 is the tokenized vault standard where users deposit an asset and receive vault shares that represent a claim on the vault's assets.

EIP-712

EIP-712 is a standard for signing typed structured data so a signature is bound to a specific message type and domain.

Permit2

Permit2 is Uniswap's shared approval and signature transfer system that lets users authorize token spends through structured signatures or managed allowances.

Token Decimals

Token decimals are ERC-20 metadata that describe how raw integer balances should be displayed, not a guarantee that every token uses 18 decimals.

Non-Standard ERC-20

A non-standard ERC-20 is a token that behaves differently from common ERC-20 assumptions, such as missing return values, fees, rebases, pauses, blacklists, or unusual decimals.

SafeERC20

SafeERC20 is an OpenZeppelin library that wraps ERC-20 calls to handle tokens that revert, return false, or return no value.

ERC-777 Hooks

ERC-777 hooks are callback functions that can run during token transfers, giving sender or recipient contracts a chance to execute code.

ERC721

ERC721 is the Ethereum token standard for non-fungible tokens where each token ID represents a unique asset with one owner.

ERC1155

ERC1155 is a multi-token standard that supports many fungible and non-fungible token IDs in one contract.

Account Abstraction

Account abstraction lets smart contract accounts define their own validation rules instead of relying only on externally owned account transaction rules.

ERC-4337

ERC-4337 is an Ethereum account abstraction standard that uses UserOperations, bundlers, paymasters, and an EntryPoint contract without changing Ethereum consensus.

UserOperation

A UserOperation is the ERC-4337 data structure that describes a smart account action, including sender, nonce, calldata, gas fields, optional paymaster data, and signature.

Bundler

A bundler is an ERC-4337 actor that receives UserOperations, simulates validation, bundles valid operations, and submits them to the EntryPoint contract.

Paymaster

A paymaster is an ERC-4337 contract that can sponsor gas for a UserOperation when its validation rules pass.

EntryPoint Contract

The EntryPoint contract is the ERC-4337 contract that validates and executes bundles of UserOperations and manages account and paymaster deposits.

ERC-20 Permit (EIP-2612)

ERC20 permit lets a token owner approve an ERC20 allowance with a signature instead of sending an on-chain approve transaction.

EIP-2612

EIP-2612 is the ERC20 permit standard that defines signature-based allowance approvals through permit, nonces, and DOMAIN_SEPARATOR.

Allowance

Allowance is the ERC20 amount an owner permits a spender to transfer from the owner's balance through transferFrom.

Approval for All

Approval For All is an ERC721 and ERC1155 operator approval that allows one address to transfer all of an owner's tokens for that contract.

Safe Transfer

Safe transfer is an NFT transfer flow that checks whether a recipient contract explicitly accepts the token through the correct receiver hook.

safeTransferFrom

safeTransferFrom is the ERC721 and ERC1155 transfer function that moves tokens and checks recipient contract acceptance.

onERC721Received

onERC721Received is the ERC721 receiver hook that a contract must implement to accept safe ERC721 transfers.

onERC1155Received

onERC1155Received is the ERC1155 receiver hook called when a contract receives a single ERC1155 token transfer.

Token URI

Token URI is the metadata pointer for an NFT, usually returned by ERC721 tokenURI or ERC1155 uri.

ERC165

ERC165 is the Ethereum standard for interface detection through supportsInterface(bytes4).

supportsInterface

supportsInterface is the ERC165 function that returns whether a contract claims support for a given interface ID.

ERC1271

ERC1271 is the standard for validating signatures from smart contracts through isValidSignature.

ERC2771

ERC2771 is a meta-transaction standard where a trusted forwarder calls a recipient contract and appends the original signer to calldata.

Trusted Forwarder

A trusted forwarder is the ERC2771 contract a recipient trusts to verify signed requests and relay calls with the original signer appended.

EIP-7702

EIP-7702 lets an externally owned account set delegated smart contract code while keeping its address.

ERC1967

ERC1967 defines standard proxy storage slots for implementation, admin, and beacon addresses.

ERC6909

ERC6909 is a minimal multi-token standard for managing many token IDs in one contract.

ERC2981

ERC2981 is the NFT royalty standard that reports royalty receiver and amount for a given token ID and sale price.

ERC721A

ERC721A is a gas-optimized ERC721 implementation designed for cheaper batch minting.

Permit Signature

A permit signature authorizes an on-chain action through signed data instead of a direct transaction from the signer.

Domain Separator

A domain separator is the EIP-712 value that binds signed data to a specific app, version, chain, and verifying contract.

Meta-Transaction

A meta-transaction is an action signed by a user off-chain and submitted on-chain by a relayer or forwarder.

Session Key

A session key is a limited key authorized by a wallet or smart account to perform constrained actions for a limited time or scope.

Smart Account Module

A smart account module is a plug-in that adds validation, execution, recovery, hooks, or other behavior to a smart account.

ERC20 Return Value

ERC20 return value refers to the boolean returned by transfer, transferFrom, and approve, and the real-world problem that some tokens return false or no data.