Use of approve Function Without safeApprove in Multiple Contracts

[code423n4]

Lines of code

https://github.com/code-423n4/2023-08-dopex/blob/eb4d4a201b3a75dd4bddc74a34e9c42c71d0d12f/contracts/amo/UniV2LiquidityAmo.sol#L136
https://github.com/code-423n4/2023-08-dopex/blob/eb4d4a201b3a75dd4bddc74a34e9c42c71d0d12f/contracts/amo/UniV3LiquidityAmo.sol#L175
https://github.com/code-423n4/2023-08-dopex/blob/eb4d4a201b3a75dd4bddc74a34e9c42c71d0d12f/contracts/core/RdpxV2Core.sol#L416
https://github.com/code-423n4/2023-08-dopex/blob/eb4d4a201b3a75dd4bddc74a34e9c42c71d0d12f/contracts/perp-vault/PerpetualAtlanticVault.sol#L248

Vulnerability details

Impact

The use of the standard approve function without the safer safeApprove alternative can lead to potential issues with certain tokens. Some tokens, such as USDT and KNC, do not allow users to approve an amount M>0 when an existing amount N>0 is already approved. This can lead to failed transactions and unexpected behavior for users interacting with these tokens.

Proof of Concept

The following are direct links to the code sections in various contracts where the standard approve function is used:

UniV2LiquidityAmo.sol - Line 136
UniV3LiquidityAmo.sol - Line 175
RdpxV2Core.sol - Line 416
PerpetualAtlanticVault.sol - Line 248
In each of these instances, the approve function is used without first checking or resetting the allowance, which can lead to issues with tokens that have the aforementioned behavior.

Tools Used

Manual review

Recommended Mitigation Steps

Replace the standard approve function with a safeApprove function that first checks the current allowance and resets it to zero if necessary before setting a new allowance.
Test the updated contracts with tokens known to have the problematic behavior (e.g., USDT, KNC) to ensure compatibility.
Consider adding comments in the code to explain the rationale behind using safeApprove to guide future developers and maintainers.

Assessed type

Token-Transfer

[c4-pre-sort]

bytes032 marked the issue as duplicate of #928

[c4-pre-sort]

bytes032 marked the issue as low quality report

[c4-pre-sort]

bytes032 marked the issue as not a duplicate

[c4-pre-sort]

bytes032 marked the issue as duplicate of #1662

[c4-judge]

GalloDaSballo marked the issue as unsatisfactory:
Out of scope