Sablier
Sablier
DeFiFoundry
53,440 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Possible failure in `SablierV2MerkleLT` and `SablierV2MerkleLL` due to asset that reverts by large approval

bube

Summary

Certain ERC-20 tokens revert when attempting to approve a very large amount (e.g., type(uint256).max). This behavior can prevent the SablierV2MerkleLT and SablierV2MerkleLL contracts from deploying successfully, as it includes a large approval in their constructors.

Vulnerability Details

The SablierV2MerkleLT and SablierV2MerkleLL contracts approve the maximum value of type(uint256) in their constructors:

SablierV2MerkleLT:

constructor(
MerkleLockup.ConstructorParams memory baseParams,
ISablierV2LockupTranched lockupTranched,
MerkleLT.TrancheWithPercentage[] memory tranchesWithPercentages
)
SablierV2MerkleLockup(baseParams)
{
LOCKUP_TRANCHED = lockupTranched;
​
// Since Solidity lacks a syntax for copying arrays of structs directly from memory to storage, a manual
// approach is necessary. See https://github.com/ethereum/solidity/issues/12783.
uint256 count = tranchesWithPercentages.length;
for (uint256 i = 0; i < count; ++i) {
_tranchesWithPercentages.push(tranchesWithPercentages[i]);
}
​
// Max approve the Sablier contract to spend funds from the MerkleLockup contract.
@> ASSET.forceApprove(address(LOCKUP_TRANCHED), type(uint256).max);
}
​

SablierV2MerkleLL:

​
constructor(
MerkleLockup.ConstructorParams memory baseParams,
ISablierV2LockupLinear lockupLinear,
LockupLinear.Durations memory streamDurations_
)
SablierV2MerkleLockup(baseParams)
{
LOCKUP_LINEAR = lockupLinear;
streamDurations = streamDurations_;
​
// Max approve the Sablier contract to spend funds from the MerkleLockup contract.
@> ASSET.forceApprove(address(LOCKUP_LINEAR), type(uint256).max);
}
​

The problem is that some tokens revert on large approval or transfer:

Some tokens (e.g. UNI, COMP) revert if the value passed to approve or transfer is larger than uint96.

https://github.com/d-xo/weird-erc20?tab=readme-ov-file#revert-on-large-approvals--transfers

If the asset is some of these tokens (that is possible because the protocol will work with any ERC20 tokens), the forceApprove function in SablierV2MerkleLL and SablierV2MerkleLT will revert. That will lead to unability the contracts to be deployed.

Impact

If the contracts SablierV2MerkleLL and SablierV2MerkleLT appove asset that reverts by large approval, the contracts can not be deployed disrupting the functionality of the protocol.

Tools Used

Manual Review

Recommendations

Approve a small amount of asset in the constructor and then when it is needed approve more before the transaction.

Updates

Lead Judging Commences

inallhonesty Lead Judge
about 1 year ago
inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

ERC20 UNI and COMP Revert on Large Approvals

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.