Making sure I understand how SafeERC20 works

[abcoathup]

Hi @PaulRBerg,

I was a bit confused whether you were referring to interacting with a token or creating a token. I assume that you are referring to a contract interacting with ERC20 tokens.

I suggest reading the reply from @frangio in SafeERC20, TokenTimelock, wrappers - #2 by frangio

SafeERC20 is not an ERC20 extension that you use to make your token safe (OpenZeppelin’s ERC20 is already safe ). It’s a helper to make safe the interaction with someone else’s ERC20 token, in your contracts.

The documentation (https://docs.openzeppelin.com/contracts/3.x/api/token/erc20) generated from README.adoc includes the following:

There a few core contracts that implement the behavior specified in the EIP:

• IERC20: the interface all ERC20 implementations should conform to.
• ERC20: the implementation of the ERC20 interface, including the name, symbol and decimals optional standard extension to the base interface.

Finally, there are some utilities to interact with ERC20 contracts in various ways.

• SafeERC20 is a wrapper around the interface that eliminates the need to handle boolean return values.
• TokenTimelock can hold tokens for a beneficiary until a specified time.

The SafeERC20 API documentation has the following:

Wrappers around ERC20 operations that throw on failure (when the token contract returns false). Tokens that return no value (and instead revert or throw on failure) are also supported, non-reverting calls are assumed to be successful. To use this library you can add a using SafeERC20 for ERC20; statement to your contract, which allows you to call the safe operations as token.safeTransfer(…​) , etc.

---

Answering your questions:

@PaulRBerg

SafeERC20.sol is an extension to the core implementation that fends off against other non-compliant tokens like BNB or OMG

SafeERC20.sol is a utility to use when interacting with ERC20 contracts.

@PaulRBerg

A contract that extends only from ERC20.sol puts its users’ funds at risk, should they ever deposit vulnerable tokens.

A contract that interacts with tokens using either IERC20.sol or ERC20.sol with a token that doesn't match IERC20 return values has potential for the tokens to be locked inside the contract.

@PaulRBerg

A contract that extends from both the core ERC20.sol and uses the SafeERC20.sol library makes it possible to both deposit and withdraw vulnerable tokens.

A contract that interacts with tokens using SafeERC20.sol can interact with a token that doesn't match IERC20 return values without risking the the tokens get locked inside the contract.