CapitalPool::approve(address) will not work for tokens that can not approve type(uint256).max
Summary
approve(address) on CapitalPool contract will not work for some tokens that don't support approve type(uint256).max amount.
Vulnerability Details
There are tokens like UNI or COMP that do not support approve spender type(uint256).max amount - they cast the amount to type(uint96).max. Nontheless - this behaviour of safe casting is not expected of every ERC20 and some could easily not support approving type(uint256).max.
Impact
Tokens that don't support approve type(uint256).max amount can not be used in the system.
Tools Used
Manual review
Recommendations
Instead of approving type(uint256).max - consider approving only the amount necessary for the transfer
Lead Judging Commences
[invalid] finding-CapitalPool-approve-uint256-max
Thanks for flagging, indeed since uint(-1) is representative of max uint256 value, when entering the `if` statement, it will be converted to uint96 max amout, so it will not revert as described. In issue #361, the mockToken utilized does not correctly reflect the below approval behavior. ```Solidity function approve(address spender, uint rawAmount) external returns (bool) { uint96 amount; if (rawAmount == uint(-1)) { amount = uint96(-1); } else { amount = safe96(rawAmount, "Comp::approve: amount exceeds 96 bits"); } ```
Appeal created
[invalid] finding-CapitalPool-approve-uint256-max
Thanks for flagging, indeed since uint(-1) is representative of max uint256 value, when entering the `if` statement, it will be converted to uint96 max amout, so it will not revert as described. In issue #361, the mockToken utilized does not correctly reflect the below approval behavior. ```Solidity function approve(address spender, uint rawAmount) external returns (bool) { uint96 amount; if (rawAmount == uint(-1)) { amount = uint96(-1); } else { amount = safe96(rawAmount, "Comp::approve: amount exceeds 96 bits"); } ```
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.