The approval for the reSDL token is not revoked during a cross-chain transfer
Summary
The SDLPoolPrimary.handleOutgoingRESDL and the SDLPoolSecondary.handleOutgoingRESDL functions do not revoke token approvals. If the transferred token is ever returned to the source chain, the approved address could potentially steal this token.
Vulnerability Details
Let's consider the following scenario:
Eva has a lock on Ethereum.
Eva gives her second address approval to use this token.
Eva transfers this token to Arbitrum using
RESDLTokenBridge.transferRESDL.Eva sells the transferred token to Bob on Arbitrum.
Bob transfers this token back to Ethereum.
Eva steals this token from Bob using the remaining approval.
As a result, Eva receives the previously sold token back.
Impact
Approvals for cross-chain transferred tokens could potentially be exploited to steal reSDL tokens.
Tools Used
Manual Review
Recommendations
Consider revoking token approvals in the SDLPoolPrimary.handleOutgoingRESDL and SDLPoolSecondary.handleOutgoingRESDL functions.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.