Smart contracts, stupid humans: new major Ethereum ERC-20 token bugs BatchOverflow and ProxyOverflow | Attack of the 50 Foot Blockchain

Smart contracts are fundamentally bad software engineering, part 666 of a never-ending series — PeckShield have been running an automatic scanner on the public Ethereum blockchain:Built on our earlier efforts in analyzing EOS tokens, we have developed an automated system to scan and analyze Ethereum-based (ERC-20) token transfers. Specifically, our system will automatically send out alerts if any suspicious transactions (e.g., involving unreasonably large tokens) occur.They’ve found a couple of beauties, which they’ve branded “BatchOverflow” and “ProxyOverflow.” These affect multiple ERC-20 tokens — which are the basis for almost all ICOs.The root cause is that smart contract coders just copy each other’s code a lot, because who needs formal methods when you can cut’n’paste’n’bodge.

Source: Smart contracts, stupid humans: new major Ethereum ERC-20 token bugs BatchOverflow and ProxyOverflow | Attack of the 50 Foot Blockchain