Submission Details
Severity:
When setting new router in StrategyArb contract the previous approve is not revoked.
Summary
There is `setRouter` function in `StrategyArb.sol` contract that when called it sets the router variable to the new router and grants approve for the new router to type(uint256).max.
router = _router;
underlying.safeApprove(router, type(uint256).max);
Vulnerability Details
There is no revoking of approval for the preious router.
There is no reason for the old router to have approval which is not used anymore.
Impact
Leaving approval of router that is not used by the protocol may become problematic in the future.
Tools Used
Manual review
Recommendations
Remove approval for the old router.
Updates
Appeal created
inallhonesty 10 months ago
Submission Judgement Published Assigned finding tags:
Old router approval is not revoked after an update
Prize pool breakdown
Total prize
16,653 OP
nSLOC
25366
OP / LOC
15,800
853
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.