Submission Details
Severity:
Unlimited Token Approvals in Constructor of BuyerAgent
Summary
The BuyerAgent contract grants unlimited token approvals (type(uint256).max) to both the Swan contract and the coordinator in its constructor, creating unnecessary risks.
Vulnerability Details
The constructor sets unlimited approvals:
constructor(
string memory _name,
string memory _description,
uint96 _royaltyFee,
uint256 _amountPerRound,
address _operator,
address _owner
) Ownable(_owner) {
// ...
swan = Swan(_operator);
// Unlimited approvals
swan.token().approve(address(swan.coordinator()), type(uint256).max);
swan.token().approve(address(swan), type(uint256).max);
}
Impact
If either the Swan contract or coordinator is compromised, all tokens could be stolen
No way to revoke or modify these approvals later
Violates the principle of least privilege
Creates a bigger attack surface for potential exploits
Tools Used
Manual Review
Recommendations
Use exact approvals for each operation:
Prize pool breakdown
Total prize
21,000 USDC
nSLOC
1,03420 USDC / LOC
20,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.