Beedle - Oracle free perpetual lending
BeedleFi
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: high

Transaction becomes revert because no approve is given before `transferFrom`

0xsmartcontract

Summary

SafeTransferFrom and transferFrom methods need allowance from owner of erc20 tokens to be used

Vulnerability Details

Both SafeTransferFrom and transferFrom functions in the ERC-20 standard require the sender to have an allowance for the ERC-20 tokens they are attempting to transfer.

The safeTransferFrom and transferFrom functions moves amount tokens from sender to recipient using the allowance mechanism. amount is then deducted from the caller’s allowance.

Impact

src/Staking.sol:
37 /// @param _amount the amount to deposit
38: function deposit(uint _amount) external {
39: TKN.transferFrom(msg.sender, address(this), _amount);
40: updateFor(msg.sender);
41: balances[msg.sender] += _amount;
42: }

OZ docs-- https://docs.openzeppelin.com/contracts/2.x/api/token/erc20#IERC20-transferFrom-address-address-uint256-

Without an allowance, the transfer will fail, and the transaction would be reverted.

Tools Used

Manuel Code Review

Recommendations

Add allowance before transferFrom

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.