Submission Details
Severity:
Tokens Protecting against Approval Race Condition can DoS ZlpVault updateAssetAllowance
Description
In ZlpVault::updateAssetAllowance ERC20 token approvals are being set, without resetting those token allowances to 0, which causes a DoS with tokens like USDT which is explicitly allowed by the contract.
Vulnerable Code
ZlpVault::updateAssetAllowance:
function updateAssetAllowance(uint256 amount) external onlyMarketMakingEngine {
@> IERC20(asset()).approve(msg.sender, amount);
}
Impact
Failure to set appropriate approvals can have severe impacts on several parts of the logic, including the liquidation logic. Therefore the Impact is to be rated high.
Tools Used
Manual Review
Recommended Mitigation
Use OpenZeppelins safeApprove or modify the code to first reset the allowance to 0 and than set a new allowance like:
function updateAssetAllowance(uint256 amount) external onlyMarketMakingEngine {
+ IERC20(asset()).approve(msg.sender, 0);
IERC20(asset()).approve(msg.sender, amount);
}
Prize pool breakdown
Total prize
70,000 USDC
nSLOC
3,25821 USDC / LOC
66,500
3,500
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.