Transfer events can lie, storage cannot: catching malicious token transfers
The article explains how malicious token transfers can fake transfer events to deceive users, while on-chain storage data provides a reliable source of truth. It discusses Apollo, a tool that analyzes storage slots to detect discrepancies between emitted Transfer events and actual token balances, helping to identify fraudulent activity.
Background
- This technical post is aimed at Solidity smart-contract developers. It explains a security pitfall: a malicious contract can fake a token "transfer" event (the standard ERC-20 log) without actually moving any tokens. Reading on-chain events alone can trick naive monitoring tools or wallets into showing a transfer that never happened.
- The fix: verify the actual balance change in the contract's storage, not just the emitted event — because storage writes are irreversible and cost real gas, while events are cheaper and easier to fake.
- ERC-20 is the dominant token standard on Ethereum and other EVM chains. Tools like Etherscan and wallet UIs often display token movements by parsing Transfer events; the article warns that this is not cryptographically trustworthy without cross-checking the underlying state.