I also wanted to flag that token standard implementations should use certified variables for query functions (e.g. what’s my balance? what transactions do I have?) for maximum security.
This is what the ICP Ledger Canister is doing, as I discovered here.