Summary

The strategy contracts (StrategyOp.sol, StrategyArb.sol, and StrategyMainnet.sol) implement a setRouter function that grants infinite token approvals to new routers without revoking approvals from previously approved routers. This could lead to security vulnerabilities if a previously approved router becomes compromised.

Vulnerability Details

When the management role calls setRouter to update the router address, the function grants an unlimited approval (type(uint256).max) to the new router without first revoking approvals from the old router address.

Code Snippet

The vulnerability exists in:

• StrategyOp.sol

• StrategyArb.sol

• StrategyMainnet.sol

Impact

Severity: High

If a previously approved router contract becomes compromised (through upgrades, vulnerabilities, or malicious actions), the attacker could:

1. Drain all underlying tokens up to the infinite approval amount

2. Front-run or manipulate swaps

3. Execute unauthorized token transfers

4. Exploit the approval across multiple transactions

The impact is heightened because:

• Approvals are for the maximum possible amount (type(uint256).max)

• Multiple routers can have simultaneous infinite approvals

• Attack could be executed at any time after router change

• Recovery requires management intervention

Tools Used

Manual code review

Recommendations

Implement proper approval revocation in the setRouter function:

Additional Recommendations

1. Consider using incremental approvals instead of infinite approvals

2. Add events for approval changes

3. Implement a maximum approval amount configuration

4. Add emergency approval revocation functionality

References

• ERC20 Approval Race Conditions

Test Cases

Added test cases should include:

Mitigation Status

Pending implementation

Proof of Concept

Prerequisites

• Management role access

• Multiple router changes

• Underlying token balance

Steps to Reproduce

1. Deploy strategy with Router A

2. Change router to Router B using setRouter

3. Verify Router A still has infinite approval

4. Using Router A account, attempt token transfer

5. Observe successful unauthorized transfer