Skip to content

Latest commit

 

History

History
40 lines (25 loc) · 871 Bytes

024.md

File metadata and controls

40 lines (25 loc) · 871 Bytes

Tame Foggy Pony

Medium

Wrong assumption about safeApprove() causing DoS

Summary

No response

Root Cause

safeApprove() does not handle tokens such as USDT that require a non-zero to zero approval, it only handles token traits such as not returning a boolean. As seen, this is expected by the protocol, thus this should be considered valid:

///@notice oz safeIncreaseAllowance controls for tokens that require allowance to be reset to 0 before increasing again

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

  1. A target swapper is approved for USDT but the full allowance is not used up
  2. For a second swap, we would revert here:
tokenIn.safeApprove(target, amountIn);
  1. This results in DoS

Impact

DoS

PoC

No response

Mitigation

Use forceApprove() instead