ERC20 Token Standard: How It Works and Key Risks

An ERC20 token is a fungible token implemented through a smart contract that follows Ethereum’s EIP-20 interface. The standard defines common functions for balances, transfers, supply and delegated spending, allowing wallets, exchanges and decentralised applications to interact with many tokens through a familiar API. Compliance improves interoperability, but it does not guarantee value, security, liquidity or legal rights.

What the ERC20 token standard defines

The canonical EIP-20 specification describes a standard API for tokens in smart contracts. It was proposed in 2015 by Fabian Vogelsteller and Vitalik Buterin. The interface made it easier for applications to support a new fungible token without inventing a different integration for every project.

• totalSupply reports the token supply.
• balanceOf reports the balance assigned to an address.
• transfer sends tokens from the caller.
• approve authorises another address or contract to spend up to an allowance.
• allowance reports the remaining authorised amount.
• transferFrom moves tokens using an allowance.
• Transfer and Approval events let applications monitor relevant changes.

Name, symbol and decimals are widely implemented metadata functions, but the original specification treats them as optional. Applications should not assume every historical contract behaves identically.

Why fungibility matters

Fungible units are interchangeable within the same token contract: one unit has the same contract-defined denomination as another. This differs from non-fungible tokens, where each identifier can represent a distinct asset. Readers can compare the models in our guide to non-fungible tokens.

The standard can represent governance tokens, utility balances, wrapped assets, stablecoins and tokenised claims. What a token economically or legally represents comes from its issuer, protocol, contracts and applicable law—not from ERC-20 itself.

How an ERC20 token transfer works

A token transfer updates balances inside the token contract. It does not move ETH, even though the transaction requires ETH to pay network gas. The sender signs a transaction, Ethereum executes the contract logic, and the contract emits a Transfer event when required.

Users must select the correct network and contract address. A ticker symbol or name is not unique, and scammers can deploy lookalike tokens. Wallet interfaces may hide these details, but the contract address remains the reliable identifier.

Approvals and allowances

Many DeFi applications need permission to move tokens on a user’s behalf. The user calls approve, setting an allowance for a spender contract. That contract can then call transferFrom up to the authorised amount.

Allowances are powerful and risky. An unlimited approval can remain active after a single transaction. If the spender is malicious, compromised or upgradeable in an unsafe way, approved tokens may be exposed. Users should verify the spender, set a suitable limit, and revoke permissions they no longer need.

ERC20 token uses

• Stablecoins: dollar- or asset-referenced balances, subject to reserve and issuer risk.
• Governance: voting or delegation rights within a protocol.
• DeFi: collateral, liquidity positions, incentives and settlement assets.
• Wrapped assets: token representations of assets from another system.
• Tokenised securities or claims: regulated rights whose legal status depends on structure and jurisdiction.
• Application credits: transferable or restricted units used within a platform.

Our updated stable coins guide explains why a standardised token interface does not itself ensure a peg or redemption right.

Major ERC20 token risks

• Contract risk: bugs, admin keys or unsafe upgrades can change outcomes.
• Approval risk: excessive allowances expose balances to spender contracts.
• Issuer risk: the organisation behind a token may fail or act against holders.
• Liquidity risk: a token may be difficult to trade without large price impact.
• Bridge risk: cross-chain versions add custodial or smart-contract dependencies.
• Oracle risk: DeFi uses may depend on incorrect or manipulated prices.
• Regulatory risk: classification and permitted distribution vary by jurisdiction.
• User error: wrong addresses, networks or contracts can cause irreversible loss.

How to assess an ERC20 token

• Confirm the official contract address and Ethereum network.
• Read the contract, documentation and credible audit reports.
• Identify minting, burning, freezing and upgrade powers.
• Review holder concentration and actual market liquidity.
• Understand the issuer, governance and legal claim.
• Inspect approvals before signing and revoke unused allowances.
• Check whether a token is native, wrapped or bridged.
• Treat yield as compensation for risk, not as a guaranteed return.

Ethereum’s current ERC-20 developer documentation provides code-level examples and the required methods and events.

The bottom line

The ERC20 token standard is successful because it gives fungible tokens a common interface. That compatibility helps wallets, exchanges and DeFi applications, but the standard says little about whether a specific token is safe, valuable or legally enforceable. Evaluate the contract, permissions, issuer and market—not just the ERC-20 label.