Sablier
Sablier
DeFiFoundry
53,440 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Protocol will not be compatible with certain tokens due to usage of ASSET.forceApprove uint256.max

mxusee

Description

inside the Contest Details, the protocol states the following:

Sablier protocol is compatible with the following:
​
2. Any ERC20 token

The docs do mention some ERC20 tokens that are OOS (rebase, fee on transfer, ERC-777, ETH, interest-bearing tokens).

certain tokens like UNI or COMP have a maximum approval limit of uint96.max tokens. As a result, attempts to approve amounts exceeding uint96.max will simply revert.

The issue arises from the fact that inside the constructor of SablierV2MerkleLT and SablierV2MerkleLL, the contract always approves the maximum amount of ASSET using uint256.max to the Sablier contract for spending.

constructor(
MerkleLockup.ConstructorParams memory baseParams,
ISablierV2LockupTranched lockupTranched,
MerkleLT.TrancheWithPercentage[] memory tranchesWithPercentages
)
SablierV2MerkleLockup(baseParams)
{
LOCKUP_TRANCHED = lockupTranched;
​
// Since Solidity lacks a syntax for copying arrays of structs directly from memory to storage, a manual
// approach is necessary. See https://github.com/ethereum/solidity/issues/12783.
uint256 count = tranchesWithPercentages.length;
for (uint256 i = 0; i < count; ++i) {
_tranchesWithPercentages.push(tranchesWithPercentages[i]);
}
​
// Max approve the Sablier contract to spend funds from the MerkleLockup contract.
-> ASSET.forceApprove(address(LOCKUP_TRANCHED), type(uint256).max);
}
constructor(
MerkleLockup.ConstructorParams memory baseParams,
ISablierV2LockupLinear lockupLinear,
LockupLinear.Durations memory streamDurations_
)
SablierV2MerkleLockup(baseParams)
{
LOCKUP_LINEAR = lockupLinear;
streamDurations = streamDurations_;
​
// Max approve the Sablier contract to spend funds from the MerkleLockup contract.
-> ASSET.forceApprove(address(LOCKUP_LINEAR), type(uint256).max);
}

This means that every time a user will try to create a campaign with for example UNIor COMP, it will always fail.

Recommendation

Do not include these tokens or change the code snippet to:

ASSET.forceApprove(address(LOCKUP_TRANCHED), type(uint96).max);
​
Updates

Lead Judging Commences

inallhonesty Lead Judge
over 1 year ago
inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

ERC20 UNI and COMP Revert on Large Approvals

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.