First Flight #9: Soulmate

Summary

The deposit function on the staking contract does not allow transferFrom() to transfer the funds from the msg.sender due to the check for allowance which is not approved anytime before.

Vulnerability Details

The deposit function on the Staking.col contract fails due to unapproved allowance from the msg.sender to the staking contract.

Impact

Users are unable to use the staking option on the protocol.

Tools Used

Forge local testing

Recommendations

Users that are willing to deposit some funds to the staking contract should approve the spending allowance. This can be most conveniently done as part of the deposit function on the Staking.sol contract.