DittoETH

Summary

Some ERC20 implementations signal approve() errors with a boolean return value instead of using revert(). Not checking this value can lead to unapproved operations proceeding.

Vulnerability Details

If developers neglect to check this return value, they might proceed with operations under false assumptions, leading to potential vulnerabilities or unintended behaviours in smart contract interactions.

Also approve can be subject to front running attacks.When a user tries to change an allowance, a spender can see this pending transaction and quickly use the current allowance before the change is mined, potentially double-spending if the user's updated allowance is also used later.

Tools Used

Manual Review

Recommendations

Simple solution would to use safeIncreaseAllowance instead of approve. It checks for boolean returns and mitigates double-spending by first setting allowances to 0 before updating to the desired value, preventing malicious timing exploits between transactions.