First Flight #5: Santa's List

Summary

It is possible to spend more token amount than what has been approved.

Vulnerability Details

Approvals are used during the life cycle of any token. As SantaToken inherits ERC20 contract an approval mechanism is there in place:

Let's consider the following scenario:

• A approves 100 Santa tokens to B with approve(B, 100)

• A decides to decrease the allowance of B to 20 tokens with approve(B, 20)

• B sees the approve(B, 20) transaction in mempool

• B pays higher fee, so that his transferFrom(A, B, 100) transaction comes before approve(B, 20) transaction made by A

• B received 100 Santa tokens and now calls transferFrom(A, B, 20)

• In total B receives 120 tokens which is more than A expects

Impact

High, because it can be implemented relatively easy if the malicious actor has access and knowledge of mempool.

Tools Used

Manual check

Recommendations

Utilize safe methods to increasing or decreasing allowance. E.g. inherit from OpenZeppelin ERC20 and use increaseAllowance / decreaseAllowance accordingly.