the real key to "legality" (in the United States, at least) is to determine if ICOs pass the "Howey Test"...

The "Howey Test" is a test created by the Supreme Court for determining whether certain transactions qualify as "investment contracts." If so, then under the Securities Act of 1933 and the Securities Exchange Act of 1934, those transactions are considered securities and therefore subject to certain disclosure and registration requirements.

Link: What Is the Howey Test?

You may also find these helpful as well:
Link: Appcoin Law: ICOs the Right Way

and for a really in-depth PDF overview...
Link: A Securities Law Framework for Blockchain Tokens (27 page PDF)