Understanding your assets in smart contract-fueled blockchain

For today’s Aiternalex Blog post we’re diving into the fascinating world of token standards. These standards are like rulebooks that define how tokens interact with each other and the blockchain they’re built on. In this friendly guide, we’ll explore the different token standards on the Ethereum (and EVM-compatible – Ethereum Virtual Machine) blockchain, and then briefly touch on how tokens work in other popular blockchains like Solana and Polkadot. So, grab a cup of coffee and let’s get started!

Ethereum and EVM-Compatible Blockchain Token Standards

Ethereum is a trailblazer in the blockchain space, so it’s only fitting that we start with its token standards. Here are some of the most widely used standards on the Ethereum network:

ERC-20

First up, we have the ERC-20, the “OG” of Ethereum token standards! This standard defines a set of rules for creating and managing fungible tokens, which are tokens with equal value (think of them as digital coins). If you’ve ever traded tokens like BAT or LINK, then you’ve dealt with ERC-20 tokens. Some key functions of the ERC-20 standard include:

• Transferring tokens between addresses
• Checking the balance of an address
• Approving the spending of tokens by a third party

ERC-721

Next, we have the ERC-721 standard, which brought us the world of non-fungible tokens (NFTs). Unlike ERC-20 tokens, each ERC-721 token is unique, making them perfect for digital collectibles, art, and other one-of-a-kind assets. The CryptoKitties craze of 2017 was built on this standard! ERC-721 tokens have similar functions to ERC-20 tokens, but with some notable differences, such as:

Each token has a unique identifier

• Tokens can be transferred, but they can’t be divided
• Metadata can be attached to describe the token’s properties

ERC-1155

The ERC-1155 standard is like the Swiss Army knife of token standards! It combines the best of both worlds, allowing for the creation of both fungible and non-fungible tokens within the same contract. This versatility makes ERC-1155 perfect for gaming platforms, as it can manage in-game currencies, items, and more. Some unique features of ERC-1155 include:

• Batch transfers of multiple token types in a single transaction
• Tokens can have both fungible and non-fungible properties
• Reduced gas fees compared to ERC-20 and ERC-721
• Token Standards on Other Blockchains

While Ethereum is undoubtedly a leader in token standards, it’s essential to look at how tokens work in other blockchain ecosystems like Solana and Polkadot.

Solana

Solana is a high-performance blockchain known for its lightning-fast transactions and low fees. It uses the SPL (Solana Program Library) token standard, which is similar to Ethereum’s ERC-20 standard. SPL tokens are fungible and can be used for various purposes, like decentralized finance (DeFi) and stablecoins. Some key features of SPL tokens include:

• High transaction throughput
• Low gas fees
• Support for cross-chain swaps and bridges

Polkadot

Polkadot’s approach to token standards is unique when compared to Ethereum or Solana. Unlike these platforms, Polkadot doesn’t have a specific, pre-defined token standard for its ecosystem. Instead, it allows individual parachains (independent blockchains) to create and implement their own token standards, providing a high degree of flexibility for projects built on the platform.

This flexibility stems from Polkadot’s core design, which emphasizes interoperability between various blockchains. As such, parachains are encouraged to establish their own token standards that best suit their specific use cases and requirements.

To facilitate seamless communication and token transfers between parachains, Polkadot employs the Cross-Chain Message Passing (XCMP) protocol. This protocol enables different parachains with their own token standards to interact and transfer tokens securely and efficiently.

In essence, Polkadot’s approach to token standards is centered around empowering individual parachains to create custom standards tailored to their needs. This allows for a more diverse range of token implementations and encourages innovation within the Polkadot ecosystem.

Blockchain is a digital ledger that records transactions across many computers. It is a distributed database, meaning there are many copies of it and new information can be added only if all participants in the network agree.

Blockchain technology is a powerful tool for improving security and reliability: however, it is not without its risks and dangers.

EXPLOITS

The most prominent risk in blockchain technology is the vulnerability to exploits. These are threats to the blockchain that arise because of bugs or violations of assumptions in the system’s design. There are two types of exploits: those that exploit bugs (e.g., denial-of-service attacks) and those that take advantage of flaws in the system’s design (e.g., reentrancy). For example, an attacker can use a denial-of-service attack to make a node go offline by sending it an overwhelming number of messages or queries that it cannot handle.

REENTRANCY

A reentrancy exploit happens when an attacker sends two different transactions at the same time, one after another, with each transaction making changes on behalf of the attacker without waiting for the other transaction to finish executing first. The second transaction will be able to carry out its changes even before the first transaction returns a response. If a blockchain’s transactions are not atomic, that means that if an attacker sends two transactions at once, and the second transaction executes before the first one finishes executing, it can carry out its changes without waiting for the first transaction to finish. This is called reentrancy and is considered to be a major problem for blockchains like Ethereal due to its reliance on smart contracts. 

Other types of security concerns

Security in blockchains is a key concern for many investors and companies who are looking at ways to use blockchain technology in their business model. In addition to the ones stated above, there are various other risks that need to be addressed such as human errors, phishing attacks, and code vulnerabilities (especially in smart contracts enabled chains).

CODE VULNERABILITIES

Code vulnerabilities are a direct consequence of the smart contracts, a form of code supported by many Blockchains. Smart contracts are computer protocols that execute the terms of a contract. The best way to think about them is as a self-operating computer program that automatically executes when certain conditions are met.

The vulnerabilities in smart contracts are caused by poor coding and bugs in the code. There is a lot of risk within them, due to the difficulty of editing after they have been deployed. Bugs can be exploited by hackers, who can use them to steal money or data from the blockchain, eg. accessing functions of the code that shouldn’t have been executable. 

In the blockchain world, smart contracts are used to automate some of the processes that are usually done manually, but as always, automation increases the level of risk.

One of the most typical vulnerabilities is the reentrancy risk stated above, which affects smart contracts in a very common way due to their method based structure with self assessed access control.

PHISHING ATTACKS

On the other side, phishing is when someone steals your credentials for a service such as logging into your bank account or social media account, by pretending to be another person who you know from an email, text message, phone call, etc. Private keys are used to sign transactions on a blockchain which means that if someone were able to steal your private key, they would have access to your funds and to all the functions of the smart contracts you deployed.

Phishing scams are, in general, the most common type of cyberattack. Malicious actors use social engineering to gain access to your private key in order to take control of your account.

It’s usually a pattern comprised of four steps:

1. Fraudsters will create a fake website that looks identical to the legitimate one;
2. They will send spam emails or messages on social media sites like Facebook, Twitter, etc.;
3. They will then trick you into entering your private key or mnemonic phrase on their site;
4. And finally, they will steal the information they need from you and use them to act on your behalf.

Phishing is not a new phenomenon but it has become more sophisticated with the advent of social media and other online tools. It can be difficult for people to recognize phishing attempts because they are made to look like legitimate messages from trusted sources.

Human Errors

Last but not least, there are many types of human errors that can lead to security breaches in blockchain networks. The most common type of human error is social engineering, which is an attack that uses deception to gain access to private information or data. Human error is a big risk in blockchain security because of its complexity. Social engineering is a type of human error that can be mitigated by ensuring people are well trained in what to do and what not to do when interacting with blockchain technology. Social engineering attacks can occur when humans are given organizational information that they’re not supposed to have access to, like passwords or keys (as stated before). We just talked about the most common type of social engineering attack – phishing – but as stated before it doesn’t stop there: other vectors of attacks are:

• spoofing, which is when someone pretends to be someone else through email or phone, usually with matching geographical location;
• vishing, which is when hackers call a victim on the phone and persuade them to give information for something that doesn’t exist.

Malicious actors: scams and rug pulls

The crypto world is full of scam projects. It is important to be able to spot them before investing in a project.

• A scam is an intentional deception or fraud, typically involving the use of false or misleading information designed to take advantage of others.
• A rugpull is a tactic used by market manipulators that involves convincing investors into buying tokens often by issuing positive statements about the project’s prospects, while having the only intention to pull (as to remove) all the value injected by users to steal it.

The crypto market is not a safe place and there are many people who want to take advantage of the lack of knowledge and experience. Scam projects are often launched by developers with the intention to steal from investors. They promise unrealistic returns in order to get more attention for their project, but in most cases, they fail miserably or just disappear without a trace. Some other ways scammers try to take advantage of inexperienced investors are:

• Promising guaranteed profits that cannot be achieved in reality
• Selling tokens at a discounted rate
• Creating fake ICOs
• Promising free tokens in return for major assets

Scams are a major problem in the crypto space. With so many projects launching and tokens being distributed, it is becoming more and more difficult for the average user to distinguish between a scam and a legitimate project.

To defend yourself from those risks, you should only invest in tokens with liquidity lock-ups. This prevents the token from being sold on the market before its release date, which reduces the chance of a scam or rugpull happening. With locked liquidity, nobody is able to pull the invested value from the project. Is also very important to be aware of the circulating supply of the token you are invested in and of the distribution of the same (tokenomics).

Having actors with unlocked high percentages of the total supply is a concrete risk.