Summary

Burning an ERC20 token amount without validating the necessary allowance for this amount.

Vulnerability Details

The TokenDivider::claimNft function is calling: ERC20ToGenerateNftFraccion(tokenInfo.erc20Address).burnFrom(````msg.sender, erc20ToMintedAmount[tokenInfo.erc20Address]````);, without ensuring the user has approved an allowance for the given amount before that. In its implementation, burnFrom validates that the burned amount is allowed to the caller, in this case the TokenDivider contract. Nowhere this is done, hence the burnFrom will revert, making the claimNft function non-functional.

Impact

The call to claimNft can fail without apparent reason.

Tools Used

reading documentation

Recommendations

Make sure to explicitly validate the allowance from the user to the contract and revert a custom exception if it doesn't cover the amount.