The Standard
The Standard
DeFiHardhat
20,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Did not Approve to zero first

atoko

Summary

Some ERC20 tokens like USDT require resetting the approval to 0 first before being able to reset it to another value. The ierc20.approve function does not do this - unlike OpenZeppelin's safeIncreaseAllowance() implementation.

Vulnerability Details

function runLiquidation(uint256 _tokenId) external {
ISmartVaultManager manager = ISmartVaultManager(smartVaultManager);
manager.liquidateVault(_tokenId);
distributeFees();
ITokenManager.Token[] memory tokens = ITokenManager(manager.tokenManager()).getAcceptedTokens();
ILiquidationPoolManager.Asset[] memory assets = new ILiquidationPoolManager.Asset[](tokens.length);
uint256 ethBalance;
for (uint256 i = 0; i < tokens.length; i++) {
ITokenManager.Token memory token = tokens[i];
if (token.addr == address(0)) {
ethBalance = address(this).balance;
if (ethBalance > 0) assets[i] = ILiquidationPoolManager.Asset(token, ethBalance);
} else {
IERC20 ierc20 = IERC20(token.addr);
uint256 erc20balance = ierc20.balanceOf(address(this));
if (erc20balance > 0) {
assets[i] = ILiquidationPoolManager.Asset(token, erc20balance);
ierc20.approve(pool, erc20balance); //@audit-info use of approve
}
}
}
LiquidationPool(pool).distributeAssets{value: ethBalance}(assets, manager.collateralRate(), manager.HUNDRED_PC());
forwardRemainingRewards(tokens);
}

##impact
This code does not first reset the allowance to zero before setting it to a new value, which can be problematic with tokens that require this pattern. The issue is that if the contract ever tries to change an already non-zero allowance, the token contract might revert the transaction or behave unexpectedly. to adhere to the best practices for broader compatibility and safety, it's recommended to implement the allowance reset pattern

Tools Used

manual review

Recommendations

It is recommended to set the allowance to zero before increasing the allowance and use safeIncreaseAllowance().

Updates

Lead Judging Commences

hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

informational/invalid

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.