The Standard

Summary

Some tokens do not implement the ERC20 standard properly but are still accepted by most code that accepts ERC20 tokens. For example, Tether (USDT)'s approve() function will revert if the current approval is not zero, to protect against front-running changes of approvals.

Vulnerability Details

In the executeERC20SwapAndFee() function in SmartVaultV3, we're approving the swapRouter to spend amountIn:

However, if the tokenIn is a token like USDT that reverts if the current approval is not zero, and there is some approval left from previous use, then this will revert and in return, the swap function will not be able to be executed.

Impact

The swap function won't work.

Tools Used

Manual review

Recommendations

Approve to 0 first.