Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

CapitalPool - DoS when approving tokens

holydevoti0n

Summary

Some ERC20 tokens (like USDT) do not work when changing the allowance from an existing non-zero allowance value. For example, Tether (USDT)'s approve() function will revert if the current approval is not zero, to protect against front-running changes of approvals.

The problem here is that the CapitalPoolnever checks for the allowance of the token, always approving it with type(uint256).max.

https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/CapitalPool.sol#L24-L38

(bool success, ) = tokenAddr.call(
abi.encodeWithSelector(
@> APPROVE_SELECTOR,
tokenManager,
@> type(uint256).max
)
);
​
@> if (!success) {
revert ApproveFailed();
}

Vulnerability Details

This will cause some tokens to revert when updating the allowance. They must first be approved by zero and then the actual allowance must be approved.

Impact

  • USDT or other ERC20 tokens that do not return a boolean for approval will cause DoS on the market, preventing users from trading.

Tools Used

Manual Review

Recommendations

Replace the current implementation with the SafeERC20.afeIncreaseAllowance from OZ.

https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/token/ERC20/utils/SafeERC20.sol

Updates

Lead Judging Commences

0xnevi Lead Judge 12 months ago
Submission Judgement Published
Invalidated
Reason: Other
Assigned finding tags:

[invalid] finding-CapitalPool-USDT-approve-zero-first

I believe this is invalid, - For weird ERC20s with front-running approval protection such as UDST (only known instance so far), max approval is likely only required to be invoked once, considering the supply cap of such tokens. (USDT supply is at 53.8 billion (53.8e9 * 1e9, so this is 100% sufficient) - If approvals are insufficient, a new proxy for tadle market can always be deployed via the TadleFactory contract and migrated

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.