Must approve 0 first

[code423n4]

Handle

cccz

Vulnerability details

Impact

Some tokens (like USDT) do not work when changing the allowance from an existing non-zero allowance value.They must first be approved by zero and then the actual allowance must be approved.

Proof of Concept

https://github.com/code-423n4/2022-01-notional/blob/main/contracts/TreasuryManager.sol#L79

Tools Used

None

Recommended Mitigation Steps

    function approveToken(address token, uint256 amount) external onlyOwner {
+      IERC20(token).approve(ASSET_PROXY, 0);
        IERC20(token).approve(ASSET_PROXY, amount);
    }

[jeffywu]

Duplicate #153

[pauliax]

A duplicate of #153