The Standard
The Standard
DeFiHardhat
20,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Some tokens can't change already set +ve approvals without first setting to zero

bauchibred

Proof of Concept

Take a look at LiquidationPoolManager.sol#L59-L82
Snippet is from LiquidationPooolManger#runLiquidation()

if (erc20balance > 0) {
assets[i] = ILiquidationPoolManager.Asset(token, erc20balance);
ierc20.approve(pool, erc20balance);
}

Issue with snippet is that some tokens can not re-approve an address if it' had a previously positive approval, i.e USDT for example requires setting the approval to 0 before setting it to any other value, now since code does not reset approval to 0 this leads to a DOS.

Impact

DOS to liquidations, since the approval is being set for these tokens per attemopt to liquidate, this wouldn't work when the token in the assets include this logic of not allowing alrterady set approvals to a different positive value, essentially causing protocol to hold on to bad debts

Recommended Mitigation Steps

First set approval of thist token to zero before setting the new value.

Updates

Lead Judging Commences

hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

informational/invalid

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.