Should call want.safeApprove(address(lp), 0);

[code423n4]

Handle

cccz

Vulnerability details

Impact

In the deposit function, when want.allowance(address(this), address(lp)) < amount, the contract should call want.safeApprove(address(lp), 0);

Proof of Concept

https://github.com/code-423n4/2022-01-sherlock/blob/main/contracts/managers/AaveV2Strategy.sol#L70-L72

Tools Used

Manual analysis

Recommended Mitigation Steps

  function deposit() external override whenNotPaused {
    ILendingPool lp = getLp();
    // Checking the USDC balance of this contract
    uint256 amount = want.balanceOf(address(this));
    if (amount == 0) revert InvalidConditions();

    // If allowance for this contract is too low, approve the max allowance
    if (want.allowance(address(this), address(lp)) < amount) {
+   want.safeApprove(address(lp), 0);
      want.safeApprove(address(lp), type(uint256).max);
    }

    // Deposits the full balance of USDC held in this contract into Aave's lending pool
    lp.deposit(address(want), amount, address(this), 0);
  }

[Evert0x]

#269