论文标题
一分钱明智和愚蠢：量化以太坊上无限批准ERC20代币的风险
Penny Wise and Pound Foolish: Quantifying the Risk of Unlimited Approval of ERC20 Tokens on Ethereum
论文作者
论文摘要
分散财务的繁荣促使许多投资者通过将其加密资产交易在以太坊生态系统的分散应用程序（简称DAPP）上进行。除了以太坊的以太货币（以太坊的本地加密货币）外，许多ERC20（一种广泛使用以太坊的标准）令牌在生态系统中获得了巨大的市场价值。具体而言，批准机制用于将用户令牌花费到DAPP的特权。通过这样做，DAPP可以代表用户将这些令牌转移到任意接收器中。为了提高可用性，DAPP通常会采用无限批准，以减少他们与用户之间所需的互动。但是，如现有的安全事件所示，可以滥用此机制以窃取用户的令牌。 在本文中，我们提出了第一项系统研究，旨在量化以太坊上无限批准ERC20代币的风险。具体而言，通过评估直到2021年7月31日的现有交易，我们发现无限批准在生态系统中普遍存在（60％，1520万/2540万），而22％的用户则具有其批准的偷窃代币的高风险。之后，我们研究了与22个代表DAPP和9个著名钱包的UIS互动中涉及的安全问题，以准备批准交易。结果表明，所有DAPP均要求前端用户的无限批准，而UIS只有10％（3/31）为批准机制提供了解释性信息。同时，只有16％（5/31）的UIS允许用户修改其批准金额。最后，我们采取进一步的一步将用户行为描述为五种模式，并将良好实践（即按需批准和及时的支出）正式化，以牢固支出获得批准的代币。但是，评估结果表明，只有0.2％的用户遵循良好做法来减轻风险。
The prosperity of decentralized finance motivates many investors to profit via trading their crypto assets on decentralized applications (DApps for short) of the Ethereum ecosystem. Apart from Ether (the native cryptocurrency of Ethereum), many ERC20 (a widely used token standard on Ethereum) tokens obtain vast market value in the ecosystem. Specifically, the approval mechanism is used to delegate the privilege of spending users' tokens to DApps. By doing so, the DApps can transfer these tokens to arbitrary receivers on behalf of the users. To increase the usability, unlimited approval is commonly adopted by DApps to reduce the required interaction between them and their users. However, as shown in existing security incidents, this mechanism can be abused to steal users' tokens. In this paper, we present the first systematic study to quantify the risk of unlimited approval of ERC20 tokens on Ethereum. Specifically, by evaluating existing transactions up to 31st July 2021, we find that unlimited approval is prevalent (60%, 15.2M/25.4M) in the ecosystem, and 22% of users have a high risk of their approved tokens for stealing. After that, we investigate the security issues that are involved in interacting with the UIs of 22 representative DApps and 9 famous wallets to prepare the approval transactions. The result reveals the worrisome fact that all DApps request unlimited approval from the front-end users and only 10% (3/31) of UIs provide explanatory information for the approval mechanism. Meanwhile, only 16% (5/31) of UIs allow users to modify their approval amounts. Finally, we take a further step to characterize the user behavior into five modes and formalize the good practice, i.e., on-demand approval and timely spending, towards securely spending approved tokens. However, the evaluation result suggests that only 0.2% of users follow the good practice to mitigate the risk.
