Submission Details
Severity:
L1vault has no check in approval amount to the bridge which might lead to call approveTo function with amount parameter more than the balanceOf vault
Summary
The approveTo() function in L1valut contract has no check for approval amount in place which might lead to call with amount more than the balance of vault.
Vulnerability Details
function approveTo(address target, uint256 amount) external onlyOwner {
token.approve(target, amount);
}
there needs to be a check statement when approving amount to target address.
Impact
When approving the amount to the target more than the balance of the vault will revert the transaction.
Tools Used
Manual review
Recommendations
Add the following require statement to the approveTo function in L1vault.
+ function approveTo(address target, uint256 amount) external onlyOwner{
+ require(amount <= token.balanceOf(address(this)), amount will not exceed the vault balance);
+ }
Rewards breakdown
nSLOC
99This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.