ERC20 balanceOf Slot Finder

A lightweight, dependency-free utility to find and utilize ERC20 token storage slots for balance mappings.

Overview

This utility provides an efficient method to find the storage slot used by ERC20 token's balanceOf mapping for a given address. It requires only a single RPC call and works with both standard and proxied ERC20 contracts (like USDC). The approach can be used for a variety of simulation purposes (e.g. transfer erc20 without owning or acquiring it) and can be adapted for other storage slots (allowance, etc.).

How It Works

The script uses a simple but powerful approach:

1. Performs a debug_traceCall on the token's balanceOf function
2. Extracts the storage slot from the EVM execution trace
3. Demonstrates how to use this slot with eth_call state overrides

Requirements

• An Ethereum provider with the debug RPC module enabled
• Bun or another JavaScript runtime

Getting a Provider with Debug RPC Method

To access the debug_traceCall method, you have several options:

• Run your own node with debug flag enabled (e.g., --http.api eth,debug)
• Find a public provider with debug methods enabled on chainlist.org (can be challenging)
• Create an account with a service provider like QuickNode and use their free trial

Usage

1. Configure the variables at the top of the script:

   • providerUrl: Your Ethereum provider URL
   • token: The ERC20 token address
   • addressToTop: The address to check balance for

2. Run the script:

   bun index.ts
   

License

MIT