Submission Details
Severity:
perivously approved routers still retain approval to spend even after change
Summary
In strategyArband strategyOp the router addresses can be changed in cases of misconfigurations or compromises.
However the approval given to such routers are not revoked.
Vulnerability Details
if the router address gets changed to a new router the previous router approval still holds and can spend tokens from the vault.
function setRouter(address _router) external onlyManagement {
router = _router;
underlying.safeApprove(router, type(uint256).max);
}
Impact
in cases of router changes the previous router can still spend the assets the strategies
Tools Used
manual review
Recommendations
revoke the previous router approval by setting it to zero
Updates
Appeal created
inallhonesty 6 months ago
Submission Judgement Published Assigned finding tags:
Old router approval is not revoked after an update
inallhonesty 6 months ago
Submission Judgement Published Assigned finding tags:
Old router approval is not revoked after an update
Prize pool breakdown
Total prize
16,653 OP
nSLOC
25366 OP / LOC
15,800
853
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.