MorpheusAI

Summary

Contract dont check return value of approve call

Vulnerability Details

As defined in the ERC20 Specification ( https://eips.ethereum.org/EIPS/eip-20 ), the approve function returns a bool that signals the success of the call. However, throughout the codebase, the value returned from calls to approve is ignored.

Issue with the same problem from OpenZeppelin - https://solodit.xyz/issues/l06-not-handling-approve-return-value-openzeppelin-alpha-finance-homora-v2-audit-markdown

Impact

the function does not process the return value, which may lead to incorrect behavior and contract configuration

Tools Used

Manual review

Recommendations

To handle calls to approve safely, even when interacting with ERC20 implementations that, incorrectly, do not return a boolean, consider using the safeApprove function in OpenZeppelin’s SafeERC20 contract for all approvals.