Approve Once, Regret Forever: On the Exploitation of Ethereum's Approve-TransferFrom Ecosystem

Nicola Ruaro, Fabio Gritti, Dongyu Meng, Robert McLaughlin, University of California, Ilya Grishchenko, Christopher Kruegel, Giovanni Vigna, University of California

34th USENIX Security Symposium · Day 1

This research paper, "Approve Once, Regret Forever: On the Exploitation of Ethereum's Approve-TransferFrom Ecosystem," presented at USENIX Security, delves into a critical class of vulnerabilities in Ethereum smart contracts known as **Approved Controllable TransferFrom (ACT)**. Authored by researchers from the University of California Santa Barbara and the University of Toronto, the paper highlights how the essential `approve` and `transferFrom` mechanisms in token standards like **ERC20** and **ERC721**, while enabling complex decentralized finance (**DeFi**) applications, also introduce a significant attack surface. If a smart contract, approved to manage a user's digital assets, contains a vulnerability that allows an attacker to control the parameters of a `transferFrom` call, the attacker can steal not only the contract's own assets but also the assets of any user who previously granted approval to that contract.

AI review

This is the kind of research that makes you reconsider assumptions baked into an entire ecosystem. UCSB's team didn't just find bugs—they systematically mapped how the approve-transferFrom pattern creates a confused deputy attack surface across 400k+ contracts, then built a tool that actually generates working exploits. The $3.4M in newly-discovered latent impact is real money sitting on the table.