Submission Details
Severity:
users can withdraw more tokens than they registered with in `LLMOracleRegistry`
Summary
when a user unregisters in the LLMOracleRegistrytheir allowance is wrongly updated, and then they can call transferFrom to send more tokens than they registered with from the registry to their account.
Vulnerability Details
The problem with the unregisteration implementation is the fact that the approval is not reset after unregistering, a user unregistering the second time will have approval for his last deposit and the new `amount`.
// approve its stake back
token.approve(msg.sender, token.allowance(address(this), msg.sender) + amount);
}
Impact
Users unregistering n+ 1 times, can drain all the tokens in the LLMRegistry contract
Tools Used
Manual Review
Recommendations
Reset the allowance after each unregistering.
Prize pool breakdown
Total prize
21,000 USDC
nSLOC
1,03420
USDC / LOC
20,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.