Submission Details
Severity:
Max approve will revert for tokens that don't support approve `type(uint256).max` amount.
Summary
Large transfers may not work with some ERC20 tokens
Some IERC20 implementations (e.g UNI, COMP) may fail if the valued transferred is larger than uint96.
Vulnerability Details
approveRewardTokens will not work for tokens that don't support approve type(uint256).max amount.
Impact
Tokens that don't support approve type(uint256).max amount could not be used by calling approveRewardTokens function.
Tools Used
Manual Analysis
Recommendations
The recommendation is made to approve only the necessay amount of token to the instead of the type(uint256).max amount.
- function approveRewardTokens(address[] calldata _tokens) external onlyOwner {
+ function approveRewardTokens(address[] calldata _tokens, uint64 amount) external onlyOwner {
address router = getRouter();
for (uint256 i = 0; i < _tokens.length; i++) {
- IERC20(_tokens[i]).safeApprove(router, type(uint256).max);
+ IERC20(_tokens[i]).safeApprove(router, amount);
}
}
Prize pool breakdown
Total prize
27,500 USDC
nSLOC
1,41419
USDC / LOC
25,000 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.