ERC-20 defines a small set of functions and events every compliant token exposes: checking a balance, transferring, approving another contract to spend on your behalf. Because the interface is fixed, any wallet, exchange or DeFi protocol can support a token it has never seen before, which is what made token issuance routine.
The standard specifies behaviour, not trustworthiness. Deploying a compliant token takes minutes and says nothing about what else its code does — nothing prevents an owner function that mints unlimited supply or blocks transfers. The approval mechanism is also the most commonly abused part of Ethereum: an unlimited allowance granted to a malicious contract lets it drain that token at any time later.
Does ERC-20 compliance mean a token is safe?
No. It means wallets can display and transfer it. The contract can still contain functions that mint, freeze or seize tokens, which the standard neither prevents nor discloses.
Last updated October 17, 2026