Frontrunning
The EIP-20 token's approve() function creates the potential for an approved spender to spend more than the intended amount. A front running attack can be used, enabling an approved spender to call transferFrom() both before and after the call to approve() is processed. More details are available on the EIP, and in this document.
Standardization
Generally speaking, smart contracts of tokens should follow an accepted and stable standard.
Examples of currently accepted standards include:
- EIP20
- EIP721 (non-fungible token)
- More at eips.ethereum.org