rUSDY:front-runnable approve

[code423n4]

Lines of code

https://github.com/code-423n4/2023-09-ondo/blob/3362e1252f3a54943e2517460e5a7988388bc821/contracts/usdy/rUSDY.sol#L276-L279
https://github.com/code-423n4/2023-09-ondo/blob/3362e1252f3a54943e2517460e5a7988388bc821/contracts/usdy/rUSDY.sol#L301-L312

Vulnerability details

Impact

rUSDY:front-runnable approve，malicious user could spend toke more than intended.

Proof of Concept

 function approve(address _spender, uint256 _amount) public returns (bool) {
    _approve(msg.sender, _spender, _amount);
    return true;
  }

Alice had approve bob 500 amount, now alice want change allowance to 200.
Alice call approve function, bob could frontrun transferfrom

  function transferFrom(
    address _sender,
    address _recipient,
    uint256 _amount
  ) public returns (bool) {
    uint256 currentAllowance = allowances[_sender][msg.sender];
    require(currentAllowance >= _amount, "TRANSFER_AMOUNT_EXCEEDS_ALLOWANCE");

    _transfer(_sender, _recipient, _amount);
    _approve(_sender, msg.sender, currentAllowance - _amount);
    return true;
  }

bob will be able to spend 500 +200 amount of alice, more than intended

Tools Used

manual

Recommended Mitigation Steps

Instead of setting the given amount, one can reduce from the current approval.

Assessed type

MEV

[c4-pre-sort]

raymondfam marked the issue as low quality report

[c4-pre-sort]

raymondfam marked the issue as duplicate of #102

[c4-judge]

kirk-baird marked the issue as unsatisfactory:
Invalid