Submission Details
Severity:
Permanent Approvals can lead to loss of funds for compromised contracts.
Summary
The contract uses type(uint256).max approvals for both the transmuter and router
While this is fairly common, it creates a permanent approval that could be dangerous if either contract is compromised.
Vulnerability Details
asset.safeApprove(address(transmuter), type(uint256).max);
underlying.safeApprove(address(router), type(uint256).max);
These max approvals for two different contract presents security risks if either contract becomes compromised.
Impact
Compromised contracts can be used to drain funds from the strategy.
Tools Used
Manual Review
Recommendations
Add ways to modify or revoke approvals for contracts.
Updates
Appeal created
inallhonesty 10 months ago
Submission Judgement Published Assigned finding tags:
Old router approval is not revoked after an update
Prize pool breakdown
Total prize
16,653 OP
nSLOC
25366
OP / LOC
15,800
853
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.