Description:
The _registerCollateralToken
function uses approve
instead of safeApprove
for ERC20 token approvals. This creates compatibility issues with non-standard ERC20 tokens (e.g., USDT) that require allowances to be reset to zero before setting a new value.
Root Cause:
Direct Use of approve
: The code uses _collateralTokenContract.approve(_aaveV3Pool, type(uint256).max)
, which does not handle tokens that revert on non-zero allowance changes.
Non-Compliant ERC20 Tokens: Tokens like USDT on Ethereum enforce a "zero-reset" before increasing allowance, causing transactions to revert if not followed.
Impact:
Denial of Service (DoS): Collateral tokens requiring allowance resets (e.g., USDT) cannot be registered, breaking core functionality.
Reduced Protocol Utility: Inability to support widely used Aave collateral assets (Medium Severity).
Recommendation:
Replace approve
with OpenZeppelin’s safeApprove
to handle non-standard tokens:
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.