ERC-20 is a technical standard for fungible tokens on Ethereum, a set of six required functions that any token contract must implement to be compatible with wallets, exchanges, and DeFi protocols. Almost every token you have ever held or traded on Ethereum, and most tokens on EVM-compatible chains, is an ERC-20 or a variant of it.
How ERC-20 works technically
The standard defines six mandatory functions: totalSupply (returns the total token supply), balanceOf (returns balance for a given address), transfer (moves tokens from caller to another address), transferFrom (moves tokens on behalf of another address, after approval), approve (grants another address permission to spend up to a specified amount), and allowance (returns how much a spender is approved to use). This small interface is what makes every ERC-20 interoperable: Uniswap doesn’t need custom code for each token, it calls the same transfer and approve functions regardless of the token.
The approve/transferFrom pattern is what happens when you “approve” a DeFi protocol. When you click “Approve USDC” on Uniswap, you’re calling the USDC contract’s approve function, granting Uniswap’s router contract unlimited (or a specified amount of) permission to move your USDC. Without the approval, the router cannot pull funds from your wallet, transfers must go through the token contract. This is why DeFi interactions require two transactions: one approval, one actual action. Token approvals interact directly with smart contract risk covered in our DeFi protocol risk guide, and the gas costs of approvals are explained in our Ethereum gas fees article.
What this means for traders
Unlimited token approvals are a persistent security risk. When you approve a contract to spend “unlimited” USDC, that approval persists until you revoke it. If the contract is later exploited or upgraded maliciously, the attacker can drain every wallet that granted unlimited approval. The 2023 Permit2 exploit by Uniswap researchers demonstrated that batch approval systems created new attack surfaces. Revoke.cash and Etherscan’s token approval checker let you audit and revoke approvals, most security-conscious DeFi users do a quarterly approval sweep.
Beyond approvals, token contract quality varies widely. ERC-20 only requires the six functions, it says nothing about mint functions, blacklisting capabilities, or fee-on-transfer mechanics. Many scam tokens include a hidden function that lets the deployer drain balances or prevent selling. USDC and USDT include blacklist functions that can freeze specific addresses (used by Circle/Tether to comply with OFAC sanctions). Fee-on-transfer tokens (some DeFi tokens charge 1–5% on each transfer) break many DeFi integrations that assume transfers are lossless. Always check the contract on Etherscan before approving unfamiliar tokens: look for mint, burn, blacklist, or setFee functions, and check if the contract is verified and audited.
A concrete example
You use Uniswap to swap 1,000 USDC for ETH. The flow: (1) You call USDC.approve(UniswapRouter, 1000), this costs one transaction and about $2 in gas. (2) You call UniswapRouter.swapExactTokensForETH, the router calls USDC.transferFrom(yourWallet, pool, 1000), moves your USDC into the Uniswap pool, and sends you ETH. You approved the router for exactly 1,000 USDC, so after the swap the allowance is 0. If you had approved “unlimited” (the default in most UIs), the router retains the ability to move any amount of USDC from your wallet until you revoke it. Six months later, if a vulnerability is found in the router contract, an attacker could drain all USDC from every wallet with an outstanding unlimited approval.
Frequently asked questions
What is ERC-721 and how is it different? ERC-721 is the standard for non-fungible tokens (NFTs). Unlike ERC-20 where every token is identical and interchangeable, each ERC-721 token has a unique ID and ownership record. You cannot merge two ERC-721 tokens or split one, they are discrete units. ERC-1155 is a hybrid standard supporting both fungible and non-fungible tokens in a single contract, common in gaming.
Do all EVM chains use ERC-20? Yes. Arbitrum, Optimism, Polygon, BNB Chain, Avalanche, and other EVM-compatible chains use the same token standard. A USDC contract on Arbitrum implements the identical ERC-20 interface as USDC on Ethereum mainnet. The tokens are not the same token, they are separate deployments, but bridging them preserves the interface.
Can ERC-20 tokens be upgraded? Only if the deployer included an upgrade mechanism. Most tokens are immutable once deployed. USDC uses a proxy pattern that allows Circle to upgrade the implementation contract, which is what enables them to add features like the blacklist. Immutable tokens (most governance tokens) cannot be changed after deployment, which is both a security property and a limitation.
