Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

use safeApprove, instead of approve #146

Closed
code423n4 opened this issue Feb 1, 2022 · 2 comments
Closed

use safeApprove, instead of approve #146

code423n4 opened this issue Feb 1, 2022 · 2 comments
Labels
bug Something isn't working disagree with severity Sponsor confirms validity, but disagrees with warden’s risk assessment (sponsor explain in comments) invalid This doesn't seem right

Comments

@code423n4
Copy link
Contributor

Handle

Randyyy

Vulnerability details

Impact

The owner of this contract can set the approval of a token to the assetproxy, however if the approval is not unlimited, and the owner want to gave the approval again for USDT token, this would revert, this can happen because it is required the set the approval to 0 first before making a new approval in the for USDT

Proof of Concept

https://github.com/code-423n4/2022-01-notional/blob/main/contracts/TreasuryManager.sol#L79
@code423n4 code423n4 added 2 (Med Risk) Assets not at direct risk, but function/availability of the protocol could be impacted or leak value bug Something isn't working labels Feb 1, 2022
code423n4 added a commit that referenced this issue Feb 1, 2022
@code423n4
Randyyy issue #146
a384602
@jeffywu jeffywu mentioned this issue Feb 6, 2022
Closed
@jeffywu jeffywu added disagree with severity Sponsor confirms validity, but disagrees with warden’s risk assessment (sponsor explain in comments) duplicate This issue or pull request already exists labels Feb 6, 2022
@jeffywu
Copy link
Collaborator

jeffywu commented Feb 6, 2022

Should be Low Risk

This was referenced Feb 6, 2022
Closed
Open
Closed
Closed
Closed
Closed
Closed
@CloudEllie CloudEllie removed the duplicate This issue or pull request already exists label Feb 8, 2022
@pauliax
Copy link
Collaborator

pauliax commented Feb 12, 2022

I think the warden does not fully understand the issue because using safeApprove does not reset the approval first, see:
https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/token/ERC20/utils/SafeERC20.sol#L53-L56

This is actually a duplicate of #153

@pauliax pauliax closed this as completed Feb 12, 2022
@pauliax pauliax added invalid This doesn't seem right and removed 2 (Med Risk) Assets not at direct risk, but function/availability of the protocol could be impacted or leak value labels Feb 12, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug Something isn't working disagree with severity Sponsor confirms validity, but disagrees with warden’s risk assessment (sponsor explain in comments) invalid This doesn't seem right
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@jeffywu @pauliax @code423n4 @CloudEllie