Dria

Swan
NFTHardhat
21,000 USDC
View results
Submission Details
Severity: medium
Invalid

UNI and COMP cant be used because of incorrect approval

Summary

In UNI and COMP (which are common tokens with a high TVL), the maximum approval that can be set is type(uint96).max. This makes these tokens to be unusable in SWAN, since the approval of tokens are set at the constructor as type(uint256).max. This will cause a revert.

Vulnerability Details

In the constructor of BuyerAgent.solthe token's approval is set. But this approval value wont work for all common ERC20 tokens. For example: UNI (used in UNISWAP) and COMP (common ERC20 tokens with a high TVL). Therefore these tokens cannot be used.

`` swan.token().approve(address(swan.coordinator()), type(uint256).max); swan.token().approve(address(swan), type(uint256).max);

(https://github.com/Cyfrin/2024-10-swan-dria/blob/c8686b199daadcef3161980022e12b66a5304f8e/contracts/swan/BuyerAgent.sol#L142-L143)

Impact

Some tokens are not usable.

Tools Used

Manual Review

Recommendations

Check if the token is UNI or COMP and use approval as type(uint96).max

Updates

Lead Judging Commences

inallhonesty Lead Judge 8 months ago
Submission Judgement Published
Invalidated
Reason: Known issue

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.