stake.link
stake.link
DeFiHardhatBridge
27,500 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Incompatible Tokens Threaten Reward Flow

ro1sharkm

Summary

The issue is that there are several popular tokens(https://github.com/d-xo/weird-erc20#revert-on-large-approvals--transfers) (UNI, COMP and others) which do not support allowances of above UINT_96. The contract will not be able to interoperate with them.

Vulnerability Details

Code snippet:

function approveRewardTokens(address[] calldata _tokens) external onlyOwner {
address router = getRouter();
for (uint256 i = 0; i < _tokens.length; i++) {
IERC20(_tokens[i]).safeApprove(router, type(uint256).max);
}
}

Certain popular tokens, like UNI and COMP, have limitations on allowances and only support values up to type(uint96).max. Approval attempts exceeding this limit will fail, leading to malfunctions and hindering reward distribution for those tokens.

Tools Used

Manual code review

Recommendations

Consider setting allowance to UINT_96. Whenever the allowance is consumed, perform re-approval up to UINT_96.

Updates

Lead Judging Commences

0kage Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.