Submission Details
Severity:
Missing remove approval for the old `router`
Summary
Missing remove approval for the old router.
Vulnerability Details
The permission of the old router hasn't been cleared, so it stil can deal with the underlying assets in the contract. This may lead to security risks.
Impact
The old router still has the authority to process the underlying assets in the contract.
Location
Recommendations
Remove the approval for the old router.
function setRouter(address _router) external onlyManagement {
underlying.safeApprove(router, 0);
underlying.safeApprove(_router, 0);
router = _router;
underlying.safeApprove(router, type(uint256).max);
}
Updates
Appeal created
inallhonesty 8 months ago
Submission Judgement Published Assigned finding tags:
Old router approval is not revoked after an update
inallhonesty 8 months ago
Submission Judgement Published Assigned finding tags:
Old router approval is not revoked after an update
Prize pool breakdown
Total prize
16,653 OP
nSLOC
25366 OP / LOC
15,800
853
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.