Part 2

Summary

The lack of using safeApprove() in the FeeDistributionBranch::convertAccumulatedFeesToWeth function exposes the protocol to potential security risks when interacting with tokens like USDT that do not return a boolean value on approval. The function currently uses the approve() method to approve token transfers, but this can lead to issues where the approval fails silently or is manipulated, as USDT does not provide feedback on the success or failure of the approval. This creates a potential for failed token swaps, unintended over-approvals, and vulnerabilities to reentrancy attacks. By not using safeApprove(), the contract lacks the necessary safeguards to ensure secure and predictable approval behavior, especially when interacting with certain tokens. Replacing approve() with safeApprove() would mitigate these risks and improve the security of the protocol.

Vulnerability Details

Impact

The use of approve instead of safeApprove in the convertAccumulatedFeesToWeth function can lead to the following issues:

1. Unreliable Approval Handling:

   • In token contracts like USDT, the approve function does not return a boolean value to confirm that the approval was successful. If the approval fails for any reason (e.g., insufficient allowance or an issue with the token contract), the contract will not be able to detect it, potentially leading to failed transactions when attempting to swap tokens. This could cause unexpected behavior or revert errors.

Tools Used

Recommendations