How Can You Tell Whether a Token Is Trustworthy?

Transcript

are >> just waiting for the slides. >> Good. So, ERC20 tokens, we're all using them without in providing liquidity, voting on governance or just plain trading. They represent funible assets. So essentially you can hold and transfer amounts of them. But that leads to a few assumptions. We assume that we are solely in control of our balances. We assume that we may transfer amounts that

we own at any given moment. But tokens are programs implemented by arbitrary code. As a result, there is nothing to guarantee that these assumptions hold. That falls on us. So, how do we go about it? First, we could try and simulate the actions we're planning on taking with regards to the token before actually performing them. So, say you're going to trade a token. You could first go and find the holder of the token. Here, I'm using our own solution, the security suite. And then once you've got the address, you can go to Foundry and try and simulate a transfer from that address to whatever other address

and check that the that the new balances match. And we can see here that they do not there is a tax on transfer. But even if there was not uh even if the simulation came back clean, we're not safe yet. You see, it's rarely the case that you're going to sell the token the moment you buy it. So what if now you're able to sell it, but that's no longer the case in the future. In fact, that's exactly how honeys work, right? There is some part of the code that may disallow certain addresses or all addresses but the owner from interacting with with a token.

So how do we check for behaviors that are not currently observable but may be enabled? Well, we could inspect the code. As a matter of fact, how many of you hold USDT? Well, good. So, let's take a look. We can see here that you're only able to transfer USDT if you're not blacklisted. So, there goes our second assumption. We can also see here that once you get blacklisted, the owner may wipe your balance. So, that's our first assumption. And we do actually see that there is an owner. It's not renounced.

So this could realistically happen. Now there is a whole social context outside of code that may allow us to trust ether. But the point I'm trying to make is that there is more to tokens than one might think. Now we were only able to do that because we have access to the source code of USDT as that was provided to us by Tether. That's not always the case. You see, more often than not, when a token is first deployed, we do not have access to the source code. Coincidentally, that is also when it sees most of its price action. So, what do we do? Well, we turn to decompilation.

You see, we might not have access to the source code, but do but we do have access to the executable, and that is in the form of EVM bite code. Now unless you're running the EVM stack machine in your head right now, this should not tell you a lot. But one of the things we do at Dub is that we provide a decompiler which can take this and turn it into this. Now this we can actually inspect for all kinds of behaviors from pausing to blacklisting to anything.

Now, there was a whole section in this talk regarding automating this process because honestly, you cannot be doing all this for every token you're planning on interacting with. But alas, we don't have the time. So, I will tell you that what my team tries to do is to automate this process. And if anybody's interested, you're more than welcome to come up to me after this talk. Thank you.