Alchemix Transmuter
Alchemix
DeFiFoundrySolidity
16,653 OP
View results
Previous Next
Submission Details
Severity: low
Invalid

Use of Deprecated OpenZeppelin safeApprove Function in StrategyArb.sol, StrategyMainnet.sol and StrategyOp.sol.

nomadic_bear

Summary

The strategies use OpenZeppelin's deprecated safeApprove function for token approvals. This function has been deprecated in favor of safeIncreaseAllowance and safeDecreaseAllowance.

Vulnerability Details

safeApprove is deprecated because it can fail when setting an approval to a non-zero value if a previous non-zero approval exists. This can happen if the contract needs to update existing allowances, leading to potential failures in token approval operations.

Found in src/StrategyArb.sol [Line: 27]()
​
```solidity
asset.safeApprove(address(transmuter), type(uint256).max);
```
​
- Found in src/StrategyArb.sol [Line: 37]()
​
```solidity
underlying.safeApprove(address(router), type(uint256).max);
```
​
- Found in src/StrategyArb.sol [Line: 44]()
​
```solidity
underlying.safeApprove(router, type(uint256).max);
```
​
- Found in src/StrategyMainnet.sol [Line: 35]()
​
```solidity
asset.safeApprove(address(transmuter), type(uint256).max);
```
​
- Found in src/StrategyMainnet.sol [Line: 45]()
​
```solidity
underlying.safeApprove(address(router), type(uint256).max);
```
​
- Found in src/StrategyOp.sol [Line: 27]()
​
```solidity
asset.safeApprove(address(transmuter), type(uint256).max);
```
​
- Found in src/StrategyOp.sol [Line: 39]()
​
```solidity
underlying.safeApprove(address(router), type(uint256).max);
```
​
- Found in src/StrategyOp.sol [Line: 50]()
​
```solidity
underlying.safeApprove(router, type(uint256).max);
```

Impact

While the function is deprecated, in this implementation the risk is minimal because:

Approvals are only set during initialization or router updates

Approvals are always set to the maximum value

No repeated approval updates in normal operation

Tools Used

manuel code review

Recommendations

Replace safeApprove with safeIncreaseAllowance:

Updates

Appeal created

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Known issue
inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Known issue

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.