The Anatomy of an ERC-20 Token and Avoiding Its Dangers From Will Warren 0x Matcha

[Music] hello hey everyone thank you for coming to this session uh I'm excited to chat about the erc20 token standard and some of the dangers associated with erc20 tokens that we've been seeing recently uh especially with the the meme coin meta and some of the steps that we can take as an industry to uh provide users with a safer uh more transparent trading experience so before diving in just a quick introduction to zerox and Mach out and what we do so hello my name is will uh co-founder and co-ceo of zerox labs uh we initially started building uh the first decentralized exchange protocol on ethereum back in 2017 and uh today most of the big wallets and defi apps out there that you might use are powered by our swap apis uh you can check them out at Zer x.org and we also have a consumer product called matcha that is the search engine for tokens in liquidity it's a DEX aggregator you can find any token that has been deployed to uh like 12 different evm blockchains within minutes and and find the very best price and part of uh the reason why we first started building zerox all those many years ago is because of the erc20 token standard and what it represents uh so our initial Vision that motivated us to build zerx and and matcha was this Vision that all forms of value will be tokenized on public blockchains like ethereum and that most trading activity will end up settling on chain uh and so this means billions of tokenized assets ranging from traditional Securities like stocks bonds uh startup Equity Fiat currencies all the way to like more abstract forms of value like digital video game items airline miles internet reputation points uh really anything that you could assign a value to would end up tokenized on public blockchain rails uh and so why is any of this important in the first place and it we believe it's because Public public blockchains uh provide us with an opportunity to uh disrupt what we view as a a uh flawed Global Financial system that's highly fragmented uh many layers and layers of middlemen uh and ultimately with tokens and globally accessible markets we can start to chip away at what we call the geographic Lottery uh and provide wider access to financial services so that's why erc20 tokens uh are important they're going to change the world and uh the way value is transferred globally but what is the erc20 token standard so the erc20 token standard it doesn't specify how a token should work uh so every single token that exists on an evm blockchain it has a unique address it has unique business logic and it has unique internal State uh but the one thing that they all share is they share an interface that specifies how a token can be interacted with uh to transfer tokens from one address to another or how to approve a different smart contract to access those tokens uh there's just a very short list of functions that are required to build a token that's compliant with the erc20 interface and the reason why this is important is because this flexibility allow ows you to design these functions to behave however you want them to behave and in providing this flexibility you can unlock all sorts of use cases for tokens uh for example like centralized stable coins that you know represent underlying USD uh you need the ability to ensure compliance to make sure that uh you know tokens can be uh you know Frozen from uh you know bad addresses and so forth on the other hand uh there are lots of ways that this flexibility can be used uh to take advantage of of non- technical users so what do you do if you want to understand how an erc20 token works if you really want to get to the heart of it and dig deep into it and and understand how it works on the inside it's not that bad you basically just open up ether scan or uh another Explorer you find the erc20 token you go down and look at the verified source code and you can see exactly how the token works all the business logic all the internal State uh and you can interpret it you can examine it uh and ultimately determine how the token behaves but there's a problem here obviously uh so C customization uh through the erc20 token standard unlocks all sorts of interesting you use cases and ways to structure ownership uh on the flip side it creates room for malicious tokens and behavior that isn't really apparent unless you go and dig into that source code and the major problem here is that again there are going to be billions of tokenized assets it's not really feasible that uh you know you go and and examine the source code for billions of unique tokens uh and then for non-technical users you're not going to be examining source code at all so how can we ensure that users don't get taken advantage of and is this actually a real risk or are we just talking about this for the sake of talking about it no this is a real risk in just the last uh year two years uh with especially with like the meme coin Trend we've just seen massive amounts of money uh stolen from users through scam tokens honeypots uh various malicious tokens that are structured to steal money from people and uh the impact on users is pretty devastating and it can have a a long-term impact on adoption and perception of crypto so what we saw a lot in this most recent uh wave of meme tokens people getting into tokens fast within a few minutes of them launching on chain barely having any info or doing any research uh and ultimately getting hurt this way of trading needs to end and we need to provide users with more useful information and protect them from getting hurt by malicious tokens so also during the last one or two years we've seen a variety of security token security tools emerge uh so from go plus uh Honeypot is quick Intel token sniffer blockade all of these different products uh are evaluating erc20 smart contracts uh and their interactions and how they function to identify token attributes that are potentially risky or outright malicious and one of the challenges is that these token security tools live in their own website most of the time so if you want to research a token and ultimately make a decision of whether or not to trade it uh you have to have multiple tabs open you have to know of these websites and it's just not something that most users are going to be able to do uh so these types of token security tools really need to be a part of the user experience when people are making a decision of whether or not they want to purchase or sell a token so there are a variety of token secur tools out there uh there are also some uh products that exist that expose these tools to users uh but the challenge is that the tools that surface this information are really geared towards prosumers who know how to navigate a complex user interface like like this uh like a deck screener or a gecko terminal and this is not any sort of uh you know uh not giving any heat to the these products they're really great products uh but they're just very Advanced and not something that most users would be comfortable navigating so how can we try and disclose this important token security information uh but maybe in a way that is a little bit more accessible ultimately how do we educate a wider segment of users so this is how we've been thinking about it for matcha so as mentioned earlier matcha is a search engine for tokens and liquidity any token that exists on uh over 10 different blockchains we support will be indexed and searchable on matcha within minutes of hitting the chain uh so we will have all of the Blue Chips as well as the the most longtail tokens that you could possibly think of they will be available on matcha uh and therefore you know we're really focused on how we can help uh users make more informed decisions uh so the way that we're approaching it is as follows first every user should know how to check a contract address so if you go to matcha you land on a token page uh every user should feel comfortable looking at that token address and confirming that this is the authentic token that was issued by the project they are they are looking to uh get into I think this is pretty trading 101 for a lot of lot of folks out there uh but not everyone knows knows to do this second we want users to check uh official links from the token issuer be able to do research uh not through second or thirdhand uh you know sources but directly from the token issuer themsel uh and you should also be able to see if a token is available on the reputable coin trackers and or listed on centralized exchanges uh so as you can see here when I again you immediately land on a token page it's very easy for you to find the resources that you need to do research on a token uh you can also very easily confirm that this token is recognized on other reputable platforms like uh coin gecko coin market cap you can see if it's listed on uh coinbase or binance third every user should know whether or not a token they are thinking about purchasing is liquid sufficiently liquid such that if they buy the token they can go and sell it if they want to and this isn't something that is very easy for users to understand today uh most products for token research what they will do is they'll maybe show you the amount of total liquidity that's available for a token within an amm pool uh like the tvl but that doesn't actually really tell you anything about whether or not you can sell that token and in how much size so with ma we have this liquidity score it's a simple 0 through1 scale that just shows you how much liquidity is available near the current price uh and therefore shows you how much you can sell into the market uh without moving the price too much and then finally going back to these token security tools that we discussed earlier every user should have access to these types of research Tools in order to not only identify if a token is malicious or not but also to just identify how a token works and understand the the business logic that dictates its its inner workings so on matcha again we also have now just launched our security audit feature and the way that this works is that at the top of the page when you're looking up a token you can see how many different properties or attributes of a token you might want to pay attention to uh you know we can't tell you whether or not any particular token attribute is dangerous or malicious or benign but what we can tell you is whether or not it's something you should understand and that should be disclosed to you before deciding to purchase a token uh so we're using go plus Labs uh as you can see here in this animation uh we have the little badge at the top uh and then a section that kind of shows the most uh kind of the most popular uh or the most commonly viewed token attributes that people are concerned about is a source code verified is this a Honeypot are there funky buy or sell taxes to be aware of uh and then you can also go deeper and really evaluate all of the different properties associated with a token so just kind of putting it all together uh if you're trying to understand what an authentic token looks like versus perhaps maybe like a copycat token that's trying to impersonate the real version uh if you go to matcha today you look up the token you land on the page you can immediately see you know if the token contract address matches if the token is recognized by trackers or centralized exchanges you can find the official links do research you can check very quickly whether or not the token has a a healthy level of liquidity uh and you can also see that in this example as well there's maybe a couple of properties of the AI xbt token that you should maybe be aware of but they aren't necessarily malicious uh and then will'll go to a copycat token oh oops a friend of mine's playing cyber buunk uh on Steam okay uh in this impersonator this impersonator token uh you can very clearly see the token contract address doesn't match there's zero liquidity so if you buy this thing you will not be able to sell it uh you can see that go plus has flag this contract is having malicious source code uh there are no links there are no uh there's no support on trackers or exchanges uh and going back between the two it's very easy to tell at a glance uh the relative security properties of the real thing and the fake all right so what does this mean for the space Where Do We Go From Here the current meme coin cycle and token launchpads they have facilitated an explosion of tokens a lot of them are interesting experiments people just you know doing interesting things within their communities a lot of these tokens are also malicious and intended to just steal money from people uh with major onboarding events like the recent uh tokens that were issued by prominent political figures brought millions of people on chain and it brought them into a space that is way too complex for them to navigate uh these users are not going to be going to these professional trading terminal user interfaces and doing deep Tok research and so what do we need to do as an industry we need to self-regulate we need to Pro provide people with the information they need to make smart decisions or at least if they're going to make stupid ones they can be more informed while they do it and what can you do as Builders you can also put in the effort to provide users with simple and relevant information about token uh security attributes uh at the time that they are deciding whether or not to make a trade and you can help them therefore avoid honey pots and other types of scams uh so we hope that uh what we have done with matcha can make uh knowledge about token security properties a little bit more accessible to a wider audience uh hopefully you know this inspires other builders to explore other ways of of accomplishing this uh that's all thank you everyone my name is Will I have Social Media stuff uh we have also mat Social Media stuff which I'm I'm sure isn't a surprise and it's all here uh but yeah thank you so much for for coming to the talk appreciate it