Part 2
Zaros
PerpetualsDEXFoundrySolidity
70,000 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Unsafe approve Usage

badal_sharma09

Description: Some tokens (like USDT) do not work when changing the allowance from a non-zero value. For example, Tether (USDT)'s approve() function will revert if the current approval is not zero to protect against front-running attacks on approval changes.

The updateVaultAssetAllowance function updates the asset allowance for a specific vault and is called by the contract owner. The new asset allowance amount is set for the vault's index token:

// File: Zaros/src/market-making/branches/MarketMakingEngineConfigurationBranch
function updateVaultAssetAllowance(uint128 vaultId, uint256 allowance) external onlyOwner {
Vault.Data storage vault = Vault.load(vaultId);
​
@> ZlpVault(vault.indexToken).updateAssetAllowance(allowance);
​
emit LogUpdateVaultAssetAllowance(vaultId, allowance);
}

The updateAssetAllowance function in ZlpVault is used to increase the allowance:

// File: Zaros/zip/ZipVault::updateAssetAllowance
function updateAssetAllowance(uint256 amount) external onlyMarketMakingEngine {
// The `onlyMarketMakingEngine` modifier ensures that the caller is the market-making engine.
// Passing `msg.sender` directly to `approve` saves one storage read.
IERC20(asset()).approve(msg.sender, amount);
}

Impact: Since updateVaultAssetAllowance is used to update the allowance for a specific vault, if the transaction fails due to an existing non-zero allowance, it may prevent updates to the vault's allowance, potentially disrupting market-making operations.

Recommendation: The function should first set the allowance to 0 before making the actual approval call. This follows best practices for ERC-20 token approvals and prevents potential reversion issues.
Consider using OpenZeppelin’s safeApprove function to ensure compatibility with all tokens.

Updates

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Known issue

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.