BatchOverflow Exploit Creates Trillions of Ethereum Tokens, Major Exchanges Halt ERC20 Deposits

A newly-discovered Ethereum smart contract exploit has resulted in the generation of billions of ERC20 tokens, causing major exchanges to temporary halt ERC20 deposits and withdrawals until all tokens can be assessed for vulnerability.

The exploit, termed the batchOverflow exploit, was first observed on the 22nd of April, when 115 octodecillion BEC was created in two transactions.

The cryptocurrency community at large only became aware of the exploit on the 24th of April when the same exploit was used on the Smart Mesh token to generate over $5 octodecillion USD in tokens.

Several major exchanges have completely shut down ERC20 token deposit or withdrawals subsequent to the transactions.

The OKEx team continued to explain that the exchange will be suspending the deposits of all ERC20 tokens until "The bug is fixed" in order to "Protect public interest." OKEx isn't the only exchange to completely halt ERC20 token deposits due to the exploit, however.

We've temporarily suspended ERC-20 token deposits and withdrawals while we review all smart contracts for exposure to the reported batchOverflow bug.

Dear Customers, ERC20 tokens are temporarily unavailable due to an exploit check.

The statement also included a reference to a transaction conducted by the party behind the Smart Mesh batchOverflow exploit, noting that the Huobi Pro system detected the deposits and did not credit them.

The implications of the exploit on the ERC20 standard are obvious - the Ethereum platform touts the effectiveness of smart contracts as "Code is law," but the fact that there is no traditional security response mechanism in place to prevent these kinds of attacks from occurring is concerning indeed.

While the party behind the exploit has been unsuccessful in this specific case, the presence of this exploit in the market is a clear sign that the extremely broad spectrum of ERC20 tokens - some of which boast per-token values that are not easy to dismiss - must be more rigorous with the manner in which smart contract functionality is implemented.