stake.link

stake.link
DeFiHardhatBridge
27,500 USDC
Ended
View results
Submission Details
Severity: low
Invalid

Unlimited Allowances for LinkToken and SDLToken Expose Funds to Siphoning Risk

https://github.com/Cyfrin/2023-12-stake-link/blob/549b2b8c4a5b841686fceb9c311dca9ac58225df/contracts/core/ccip/base/SDLPoolCCIPController.sol#L52-L53

Summary

The contract grants maximum possible allowances (type(uint256).max) of LinkToken and SDLToken to the _router. This practice can lead to catastrophic consequences if the _router is compromised. Attackers could exploit this unlimited access to drain funds from the contract.

Vulnerability Details

Code snippets:

linkToken.approve(_router, type(uint256).max);
sdlToken.approve(_router, type(uint256).max);

Impact

A compromised _router could drain the entire contract's holdings of LinkToken and SDLToken.

Tools Used

Manual Review

Recommendations

Modify the code to approve only the exact amounts of tokens required for specific transactions.

Updates

Lead Judging Commences

0kage Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Design choice

Same can be said if the owner of SDLCCIPController is compromised.

giving max approval is common in Web3 to avoid unnecessary gas, specially when the contract that has that max approval is also controlled by same owner.

Design choice with accepted risk.

Support

FAQs

Can’t find an answer? Join our Discord or follow us on Twitter.

Cyfrin
Updraft
CodeHawks
Solodit
Resources