Submission Details
Severity:
Contract use infinite approval, this can be dangerous if the approved contract becomes compromised
Summary
Contract use infinite approval, this can be dangerous if the approved contract becomes compromised
Vulnerability Details
File : SDLPoolCCIPController.sol
linkToken.approve(_router, type(uint256).max);
sdlToken.approve(_router, type(uint256).max);
File : WrappedTokenBridge.sol
linkToken.approve(_router, type(uint256).max);
token.approve(_wrappedToken, type(uint256).max);
wrappedToken.approve(_router, type(uint256).max);
File : SDLPoolCCIPControllerPrimary.sol
IERC20(_tokens[i]).safeApprove(router, type(uint256).max);
Impact
If a contract that has been approved is hacked, the impact will be very large. All approved token can be stolen by malicious actor
Tools Used
Manual review
Recommended Mitigation
Consider approving according to the number of tokens to be transferred
Prize pool breakdown
Total prize
27,500 USDC
nSLOC
1,41419 USDC / LOC
25,000 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.