Submission Details
Severity:
Token Withdrawals Circumvent Approval Checks
Summary
The contract functions do not validate that sufficient token approval has been granted prior to transferring balances. This allows an attacker to move tokens without the owner's consent.
Impact
Tokens can be stolen by bypassing approval
Tools Used
Manual Review
Recommendations
Validate the contract has been approved to move at least the transfer amount before transferring any tokens. Revert on insufficient approval.
Prize pool breakdown
Total prize
35,000 USDC
nSLOC
2,28915 USDC / LOC
33,000 USDC
2,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.