Submission Details
Severity:
ERC20 missing return value check
Description: The deposit function performs an ERC20.approve() call but does not check the success return value.
Some tokens do not revert if the approval failed but return false instead.
function deposit(
uint128 vaultId,
uint128 assets,
uint128 minShares,
bytes memory referralCode,
bool isCustomReferralCode
)
external
{
--SNIP--
@> IERC20(ctx.vaultAsset).approve(indexTokenCache, ctx.assetsMinusFees);
--SNIP--
}
Impact: Tokens that don't actually perform the approve and return false are still counted as a correct approve.
Recommended Mitigation Steps:
We recommend using OpenZeppelin’s SafeERC20 versions with the safeApprove function that handles the return value check as well as non-standard-compliant tokens.
Prize pool breakdown
Total prize
70,000 USDC
nSLOC
3,25821 USDC / LOC
66,500
3,500
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.