DeFiFoundrySolidity
16,653 OP
View results
Submission Details
Severity: medium
Invalid

Using `safeApprove` in StrategyOp will cause contract to not work with latest OZ version as it is deprecated.

Summary

The `StrategyMainnet` uses safeApprove function which is deprecated in the new version of OpenZeppelin as stated in version 4.8.0:
https://github.com/OpenZeppelin/openzeppelin-contracts/blob/49c0e4370d0cc50ea6090709e3835a3091e33ee2/contracts/token/ERC20/utils/SafeERC20.sol#L40

Furthermore it is unsafe and it's usage is discouraged.

Vulnerability Details

Usage of `safeApprove`:

https://github.com/Cyfrin/2024-12-alchemix/blob/82798f4891e41959eef866bd1d4cb44fc1e26439/src/StrategyOp.sol#L27

As stated in the OZ documentation:

This function has issues similar to the ones found in
{IERC20-approve}, and its usage is discouraged.
Whenever possible, use {safeIncreaseAllowance} and
{safeDecreaseAllowance} instead.

Impact

Protocol will not work with latest OZ libraries.

Usage of safeApprove is strongly discouraged.

Tools Used

Manual review.

Recommendations

As stated in the OZ documentation , it is better to use safeIncreaseAllowance

Updates

Appeal created

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Known issue
inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Known issue

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.