0x0 - Staking Token Deprecated Function

[sherlock-admin]

0x0

medium

Staking Token Deprecated Function

Summary

The staking token is used for underwriting loans and earns rewards from the comptroller. The approval mechanism for the staking ERC20 uses a deprecated method which could result in a race condition for users wishing to stake.

Vulnerability Detail

safeApprove() is deprecated OpenZeppelin/openzeppelin-contracts#2268 and its usage is discouraged.

Its implementation is vulnerable to a race condition. More information here: https://swcregistry.io/docs/SWC-114

Impact

Users could be exposed to front running attacks.

Code Snippet

        erc20Token.safeApprove(assetManager, 0);
        erc20Token.safeApprove(assetManager, amount);

Tool used

Manual Review

Recommendation

Prevent a call to approve if all the previous tokens are not yet spent.

[GeraldHost]

unioncredit/union-v2-contracts#55