stake.link

stake.link
DeFiHardhatBridge
27,500 USDC
View results
Submission Details
Severity: low
Invalid

Unlimited Allowances for LinkToken and SDLToken Expose Funds to Siphoning Risk

Summary

The contract grants maximum possible allowances (type(uint256).max) of LinkToken and SDLToken to the _router. This practice can lead to catastrophic consequences if the _router is compromised. Attackers could exploit this unlimited access to drain funds from the contract.

Vulnerability Details

Code snippets:

linkToken.approve(_router, type(uint256).max);
sdlToken.approve(_router, type(uint256).max);

Impact

A compromised _router could drain the entire contract's holdings of LinkToken and SDLToken.

Tools Used

Manual Review

Recommendations

Modify the code to approve only the exact amounts of tokens required for specific transactions.

Updates

Lead Judging Commences

0kage Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.