Submission Details
Severity:
Unlimited Allowances for LinkToken and SDLToken Expose Funds to Siphoning Risk
Summary
The contract grants maximum possible allowances (type(uint256).max) of LinkToken and SDLToken to the _router. This practice can lead to catastrophic consequences if the _router is compromised. Attackers could exploit this unlimited access to drain funds from the contract.
Vulnerability Details
Code snippets:
linkToken.approve(_router, type(uint256).max);
sdlToken.approve(_router, type(uint256).max);
Impact
A compromised _router could drain the entire contract's holdings of LinkToken and SDLToken.
Tools Used
Manual Review
Recommendations
Modify the code to approve only the exact amounts of tokens required for specific transactions.
Prize pool breakdown
Total prize
27,500 USDC
nSLOC
1,41419 USDC / LOC
25,000 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.