Track 5 · Tokens · lesson 5

Stop reinventing this

10 min

You wrote an ERC-20 by hand two lessons ago. Now stop doing that.

OpenZeppelin Contracts is the standard library of Solidity: audited, battle- tested implementations of every token standard, access control, pausing, upgradeability and reentrancy protection.

It secures tens of billions of dollars. Your hand-written version secures your confidence, which was the point of writing it — and is now the point of retiring it.

What using it looks like

import "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import "@openzeppelin/contracts/access/Ownable.sol";

contract Proof is ERC20, Ownable {
    constructor() ERC20("Proof", "PRF") Ownable(msg.sender) {
        _mint(msg.sender, 1000 * 10 ** decimals());
    }

    function mint(address to, uint256 amount) public onlyOwner {
        _mint(to, amount);
    }
}

Eight lines for a capped, ownable, mintable token. Every function you wrote by hand is inherited, and each has been read by more auditors than you will ever hire.

The Forge in this course compiles one file with no module resolution, so those imports cannot run here. You will use them for real in track 6, once you have Foundry on your own machine.

The parts worth knowing

ERC20, ERC721, ERC1155 — the token standards, complete.
Ownable — the owner and onlyOwner you wrote in track 4, plus safe two-step ownership transfer.
AccessControl — roles rather than a single owner. What you want the moment more than one person needs permissions.
ReentrancyGuard — the nonReentrant modifier. Track 7's subject.
Pausable — the emergency stop that track 3 said to build in advance.
SafeERC20 — wrappers for tokens that misbehave. More on that below.

Predict

Why does SafeERC20 exist, if ERC-20 defines what transfer must do?

Because some widely used tokens don't follow the standard exactlyBecause transfer can be reenteredBecause it's cheaper on gas

Read it, don't just import it

The library's real value to you right now is as the best-annotated Solidity you can read for free. ERC20.sol is a few hundred well-commented lines, and every decision has a reason you can go and find.

When you meet a pattern in the wild you don't recognise, there is a good chance OpenZeppelin implements it and explains why.

Check

You need three people to hold different permissions on a contract. Which do you reach for?

AccessControlOwnable, with the owner sharing their keyThree separate contracts

Worth remembering

OpenZeppelin is Solidity's standard library — audited implementations of the standards you just wrote by hand.
Ownable for one owner, AccessControl for roles, ReentrancyGuard and Pausable for safety.
SafeERC20 exists because real tokens like USDT deviate from the standard.
The library is also the best free reading material for learning idiomatic Solidity.
Write it once yourself to understand it; import it forever after.