stake.link
stake.link
DeFiHardhatBridge
27,500 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Lack of Initial Approval Reset in approveRewardTokens Function

daniel526

Summary

The approveRewardTokens function in the provided Solidity contract lacks the essential step of resetting the token allowance to zero before granting new approval to the CCIP router. This omission may introduce potential security and state-related risks.

Vulnerability Details

The approveRewardTokens function is designed to approve the CCIP router to transfer tokens on behalf of the contract. However, it fails to reset the token allowance to zero before granting a new approval. Without this precaution, the contract may be susceptible to issues related to existing allowances, potential front-running attacks, or unexpected state changes.

/**
* @notice Approves the CCIP router to transfer tokens on behalf of this contract
* @param _tokens list of tokens to approve
**/
function approveRewardTokens(address[] calldata _tokens) external onlyOwner {
address router = getRouter();
for (uint256 i = 0; i < _tokens.length; i++) {
// Lack of initial allowance reset to zero
IERC20(_tokens[i]).safeApprove(router, type(uint256).max);
}
}

Impact

The lack of initial allowance reset may lead to unexpected behavior, potential security vulnerabilities, or front-running attacks when interacting with ERC-20 tokens.

Tools Used

Manual

Recommendations

Ensure the approveRewardTokens function resets the token allowance to zero before granting new approval. Modify the function as follows:

function approveRewardTokens(address[] calldata _tokens) external onlyOwner {
address router = getRouter();
for (uint256 i = 0; i < _tokens.length; i++) {
// Reset allowance to zero before granting new approval
IERC20(_tokens[i]).safeApprove(router, 0);
IERC20(_tokens[i]).safeApprove(router, type(uint256).max);
}
}
Updates

Lead Judging Commences

0kage Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.