Dria
Swan
NFTHardhat
21,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Wrong approval in `LLMOracleRegistry::unregister`

fourb

Summary

When [`LLMOracleRegistry::unregister()`](https://github.com/Cyfrin/2024-10-swan-dria/blob/c8686b199daadcef3161980022e12b66a5304f8e/contracts/llm/LLMOracleRegistry.sol#L117) is called, it tries to approve the user back of the allowance consumed when registering but the case is that the order of approval is wrong so the user's approval to the contract will still be 0

Vulnerability Details

Looking at register we will find this check:

if (token.allowance(msg.sender, address(this)) < amount) {
revert InsufficientFunds();
}

it checks whether the allowance approved for the contract is greater than or equal to the stakeAmount other wise it reverts

but whenever the user tries to unregister an oracle, it tries to restore back the allowance. through this check:

function unregister(LLMOracleKind kind) public returns (uint256 amount) {
amount = registrations[msg.sender][kind];
​
// ensure the user is registered
if (amount == 0) {
revert NotRegistered(msg.sender);
}
​
// unregister the user
delete registrations[msg.sender][kind];
emit Unregistered(msg.sender, kind);
​
// approve its stake back
//--> token.approve(msg.sender, token.allowance(address(this), msg.sender) + amount);
}

looking here the approval done here will increase (address(this),msg.sender) allowance instead of (msg.sender,address(this)).

considering this check anytime the unregister is called followed by register the allowance check in register will always revert since the approval was restored wrongly.

Impact

The allowance is allocated wrongly, as a result the allowance is not restored and register checks will revert.

Tools Used

manual review

Recommendations

Th approval logic has to be revisited

Updates

Lead Judging Commences

inallhonesty Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.