Progress on EIP-7417
On November 30, the EIP-7417 smart contract (view on Etherscan) was deployed on Ethereum's mainnet. This followed an extended process of debugging and issue resolution.
Since EIP-7417 is currently under review by EIP editors, feedback was received from them as well. Their primary requests focused on improving the smart contract's documentation.
EIP-7417 aims to become a standard because there should be only one ERC-20 🔁 ERC-223 token converter for each EVM blockchain. To achieve this, the project involves collaboration with internal and external auditors, as well as consultations and meetings with EIP editors. While time-consuming, this work is critical, as the EIP-7417 token converter is a key component of the ERC-223 ecosystem and the broader DEX223 ecosystem.
The progress of EIP editor reviews can be tracked on its GitHub page.
Identified and Resolved Issues
The following issues were identified and resolved during the development process:
- Uncontrolled Native Currency Transfer
- Problem: The contract logic dictated that native currency should be transferred after token transfer. However, gas limitations allowed the transfer of native currency but prevented updates to the recipient contract's state, resulting in incorrect accounting of incoming native currency.
- Solution: Solution: Changes were made to the contract code regarding forwarding gas (GitHub commit).
- "Stuck" Native Currency in the Token Contract
- Problem: If a payment involving both native currency and tokens was canceled, the native currency would be sent to the token contract address instead of the sender's address.
- Solution: A condition was added (GitHub commit) ensuring that refunded native currency always returns to the sender.
- Potential Exploit to Withdraw ERC-223 Tokens Through ERC-20 Extraction Function
- Problem: The function extractStuckERC20 allows the recovery of incorrectly sent ERC-20 tokens, but a potential vulnerability could have allowed it to extract ERC-223 tokens. While the risk was minimal due to the function being restricted to a specific administrative address, it was classified as a vulnerability.
- Solution: A validation condition was added (GitHub commit), enabling token type recognition and prohibiting the extraction of ERC-223 tokens through this function.
It is noteworthy that these issues were identified during continuous code reviews and promptly resolved, rather than being discovered after deployment. The code underwent rigorous community testing and expert audits before any tokens of real value passed through the converter. This proactive approach contrasts with common practices in the cryptocurrency industry, where vulnerabilities often surface after users have deposited funds.
The team continues to work with EIP editors to promote EIP-7417 as a recognized standard.
Conclusion
The EIP-7417 contract has been deployed on the Ethereum mainnet after the fixes. The first USDT ERC-223 tokens (view on Etherscan) have already been issued by wrapping ERC-20 tokens through the converter. The initial trading platforms for USDT ERC-223 (source) will include the centralized exchange BitMart and DEX223.
EIP-7417 must still go through all EIP stages to finalize the proposal. In this context, the progress indicates that the review process may soon conclude, leading to the formal recognition of EIP-7417 as a standard for Ethereum and all EVM-compatible blockchains.