Submission Details
Severity:
Approving MAX_UINT amount of ERC20 tokens
Summary
The code grants maximum allowances (type(uint256).max) of linkToken and sdlToken to the _router.
This practice, while common for gas optimization, has proven to increase the impact of an attack many times in the past, in case the approved contract gets hacked.
Impact
Compromised routers can siphon unlimited funds.
Tools Used
Manual Analysis
Recommendations
Consider approving the exact amount that’s needed to be transferred, or alternatively, add an external function that allows the revocation of approvals.
Prize pool breakdown
Total prize
27,500 USDC
nSLOC
1,41419 USDC / LOC
25,000 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.