Cyfrin CodeHawks | #30 - repayBadDebtWithCash() fails without prior approval

Summary

The effect of missing an approve() call in repayBadDebtWithCash() function is that the transferFrom() function will fail. This is because the transferFrom() function relies on the allowance set by the approve() function to ensure that the transfer amount is within the approved limit. Without an approve() call, the contract does not have the necessary permissions to transfer tokens from the sender's address.

Vulnerability Details

https://github.com/Cyfrin/2024-03-Moonwell/blob/e57b8551a92824d35d4490f5e7f27c373be172bd/src/MErc20DelegateFixer.sol#L30-L43

    function repayBadDebtWithCash(uint256 amount) external nonReentrant {
        /// Checks and Effects
        badDebt = SafeMath.sub(badDebt, amount, "amount exceeds bad debt");


        EIP20Interface token = EIP20Interface(underlying);

       // @audit Missing approval

        /// Interactions
        require(
            token.transferFrom(msg.sender, address(this), amount),
            "transfer in failed"
        );


        emit BadDebtRepayed(amount);
    }

The missing approve() call means that the contract does not have the permission to transfer the specified amount of tokens from the sender's address. This results in the transferFrom() function failing, as it checks the allowance set by the approve() function to ensure the transfer amount is within the approved limit.

Impact

Due to this omission, the function cannot proceed with repaying bad debt as intended without the necessary approval.

Tools Used

Manual Review

Recommendations

In repayBadDebtWithCash() function, before calling transferFrom(), you should ensure that the sender has approved the contract to spend the amount of tokens. This can be done by calling the approve() function on the ERC20 token contract, specifying the contract's address as the spender and the amount to be approved.

Here's how you could modify this to include the approve() call:

function repayBadDebtWithCash(uint256 amount) external nonReentrant {
    /// Checks and Effects
    badDebt = SafeMath.sub(badDebt, amount, "amount exceeds bad debt");

    EIP20Interface token = EIP20Interface(underlying);

    /// Interactions
    // Approve the contract to spend the amount of tokens
    require(
        token.approve(address(this), amount),
        "approval failed"
    );

    require(
        token.transferFrom(msg.sender, address(this), amount),
        "transfer in failed"
    );

    emit BadDebtRepayed(amount);
}

Moonwell

repayBadDebtWithCash() fails without prior approval

Summary

Vulnerability Details

Impact

Tools Used

Recommendations

Lead Judging Commences

Prize pool breakdown

Live

Judging

Appeals

Appeals Review

Rewards Distribution

FAQs