I am having an argument with some people and they said that an Ecr20 token creator removed a token from one of their wallet and i told them that tokens that has been sent cannot be withdrawn back as long as they're the only ones with their private key but they don't believe me.
I want to send them a link to this thread with opinions of crypto experts in this forum so we can know who is right.
Yes you can do that with Ethereum tokens but you can't call them ERC20... rather "shitty tokens" I would say
In fact in many ERC20 smart contracts you can transfer coins of other people... but only
if they allow you to do it
This is the "allowance" function : the owner of the coins allows the address he chooses to send his coins to whoever the address wants, in the maximum amount he defines.
For example in the BNB smart contract, you will find :
https://etherscan.io/address/0xB8c77482e45F1F44dE1745F52C74426C631bDD52#code /* Allow another contract to spend some tokens in your behalf */
function approve(address _spender, uint256 _value)
returns (bool success) {
if (_value <= 0) throw;
allowance[msg.sender][_spender] = _value;
return true;
}
msg.sender is the variable that brings the address of the user executing the contract, so as you can see, the contract just fulfills a box of a matrix corresponding to your address and the address of your mandatary with the maximum amount you've allowed
/* A contract attempts to get the coins */
function transferFrom(address _from, address _to, uint256 _value) returns (bool success) {
if (_to == 0x0) throw; // Prevent transfer to 0x0 address. Use burn() instead
if (_value <= 0) throw;
if (balanceOf[_from] < _value) throw; // Check if the sender has enough
if (balanceOf[_to] + _value < balanceOf[_to]) throw; // Check for overflows
if (_value > allowance[_from][msg.sender]) throw; // Check allowance
balanceOf[_from] = SafeMath.safeSub(balanceOf[_from], _value); // Subtract from the sender
balanceOf[_to] = SafeMath.safeAdd(balanceOf[_to], _value); // Add the same to the recipient
allowance[_from][msg.sender] = SafeMath.safeSub(allowance[_from][msg.sender], _value);
Transfer(_from, _to, _value);
return true;
}
After checking the allowance matrix, the transfer just consists in a substraction on your balance and an addition on the recipient balance(ie the recipient of the mandatary).
So as you can see it's really simple to code a contract doing the same thing without calling an "allowance" function before...
Unlike Bitcoin where transactions are irreversible, ERC20 tokens based on smart contracts allow the contract creator to take back sent tokens.
Just like you, I used to believe it can't be done. Untill I had a long conversation with another member (
omer-jamal) about this subject and we decided to test it. He created a smart contract on testnet
0x29555479daf420c32157e03c7c4b0cfebda37eee and he was able to send me few tokens then take them back although he didn't know my address private key nor I did have Eth to pay Gas fee.
The moral here is that you must read the smart contract of the token you want to invest in.
If you decompile the smart contract with the decompiler, you will see the transferFrom function doesn't test the "allowance" matrix to transfer the coins, the transferFrom function just updates the balances...
An user of this smart contract can transfer the coins of whatever address he wants.
https://ropsten.etherscan.io/bytecode-decompiler?a=0x29555479daf420c32157e03c7c4b0cfebda37eee#
