Summary

It is important to check the return value when calling approve on an arbitrary ERC20 token to prevent silent failures.

Vulnerability Details

Not all IERC20 implementations revert when there's a failure in approve.
The function signature has a boolean return value and they indicate errors
that way instead. By not checking the return value, operations that should
have marked as failed, may potentially go through without actually approving
anything.

Impact

If an approval fails without the contract realising, future operations would likely not be possible due to the missing allowance, which could severely affect critical operations of the relevant contract and even the entire protocol.

Tools Used

Manual review

Recommendations

Check that the return value of each call to approve is true, and revert otherwise.