Tadle

Summary

The approve function performs a low-level call to tokenAddr. If the call fails, the transaction will revert. However, using low-level calls without checking return values can lead to unnoticed failures or unexpected behaviours.

Vulnerability Details

A malicious token contract could always return true, even if the approve call fails or does something malicious. This could lead to unauthorised transfers or other unexpected behaviour

Impact

If an attacker manages to bypass the approval mechanism, they could potentially drain the entire token balance of the contract. The loss would depend on the balance of the token at the time of the attack but could be catastrophic if the contract holds significant funds

Tools Used

Manual review

CODE SNIPPET

Recommendations

Use the IERC20 interface and it's approve function to avoid low-level calls