Part 2
Zaros
PerpetualsDEXFoundrySolidity
70,000 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Unsafe approve Usage

badal_sharma09

Description: Some tokens (like USDT) do not work when changing the allowance from a non-zero value. For example, Tether (USDT)'s approve() function will revert if the current approval is not zero to protect against front-running attacks on approval changes.

The updateVaultAssetAllowance function updates the asset allowance for a specific vault and is called by the contract owner. The new asset allowance amount is set for the vault's index token:

// File: Zaros/src/market-making/branches/MarketMakingEngineConfigurationBranch
function updateVaultAssetAllowance(uint128 vaultId, uint256 allowance) external onlyOwner {
Vault.Data storage vault = Vault.load(vaultId);
​
@> ZlpVault(vault.indexToken).updateAssetAllowance(allowance);
​
emit LogUpdateVaultAssetAllowance(vaultId, allowance);
}

The updateAssetAllowance function in ZlpVault is used to increase the allowance:

// File: Zaros/zip/ZipVault::updateAssetAllowance
function updateAssetAllowance(uint256 amount) external onlyMarketMakingEngine {
// The `onlyMarketMakingEngine` modifier ensures that the caller is the market-making engine.
// Passing `msg.sender` directly to `approve` saves one storage read.
IERC20(asset()).approve(msg.sender, amount);
}

Impact: Since updateVaultAssetAllowance is used to update the allowance for a specific vault, if the transaction fails due to an existing non-zero allowance, it may prevent updates to the vault's allowance, potentially disrupting market-making operations.

Recommendation: The function should first set the allowance to 0 before making the actual approval call. This follows best practices for ERC-20 token approvals and prevents potential reversion issues.
Consider using OpenZeppelin’s safeApprove function to ensure compatibility with all tokens.

Updates

Lead Judging Commences

inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Known issue

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!