Part 2

Summary

The updateAssetAllowance function uses msg.sender directly to call the approve function of the asset token contract.

Vulnerability Details

The updateAssetAllowance function uses msg.sender directly to call the approve function of the asset token contract. This could potentially allow a malicious user to call the updateAssetAllowance function and approve the asset token for their own address, rather than the MarketMakingEngine contract.

Impact

High. A malicious user could approve the asset token for their own address, potentially leading to unauthorized access and misuse of the asset token.

Tools Used

Manual code review and analysis.

Recommendations

Use the marketMakingEngine address stored in the ZlpVaultStorage struct to call the approve function, rather than msg.sender.