underlying tokens can be stolen from the strategy by malicious manager
Summary
the function setRouter(address _router) external is called by the manager to set the router address
The previously approved tokens are not automatically revoked if the router address is updated. This creates a risk where, if the old router contract is vulnerable or is controlled by a malicious actor, it could still access and transfer the underlying tokens due to the existing approval.
Vulnerability Details
changing routers does not revoke the tokens approved.
Impact
leaving the changed router with token approval creates the risk of underlying token theft.
Tools Used
Manual audit.
Recommendations
consider revoking the approved tokens when the router is changed
Appeal created
Old router approval is not revoked after an update
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.