[Ethereum] Send tokens using approve and transferFrom vs only transfer

contract-developmenterc-20tokens

We can send tokens using below ERC20 contract methods

approve() and transferFrom()
transfer()

Here if i use 2nd option the tokens are directly transferred, while if i use 1st option its a two step process

I am new to this and i want to understand the difference between the two ways?

Best Answer

Transfer method

The transfer method is for a 2 party transfer, where a sender wishes to transfer some tokens to a receiver.

Sender ➜ transfer(receiver, amount)

Approve and transferFrom method

The approve + transferFrom is for a 3 party transfer, usually, but not necessarily that of an exchange, where the sender wishes to authorise a second party to transfer some tokens on their behalf.

Sender ➜ approve(exchange, amount)
Buyer ➜ executes trade on the Exchange
Exchange ➜ transferFrom(sender, buyer, amount)

Related Solutions

[Ethereum] Prevent double withdrawal ERC20 API attack

EIP20 refers readers to the MiniMeToken implementation regarding this issue which works around it by adding the line:

require((_amount == 0) || (allowed[msg.sender][_spender] == 0));

EIP20 refers readers to two example token implementations (I've linked to the relevant line numbers):

OpenZeppelin - Brief issue description and link to the original issue comment. Mentions "[o]ne possible solution to mitigate this race condition", but doesn't implement it.
ConsenSys - no mention or attempt to work around the issue

The MiniMeToken function comment says:

This is a modified version of the ERC20 approve function to be a little bit safer

Given this is the reference implementation, I would like to be a lot more confident than "a little bit safer".

There is no backward compatible resolution to this problem, and the solution is still being discussed.

Web3.js ERC20 Token Transfer – How to Transfer Tokens Between Accounts

You cannot send tokens directly from one address to another address. Tokens balances only exist in the Token contract storage. You necessarily have to send a transaction to the contract indicating you want to make a tranfer, so the contract can update the balances accordingly.