Submission Details
Severity:
USDT's non-standard approve behavior can cause deposits to fail
Description:
The PerpetualVault contract supports USDT as a collateral token
/**
* @notice
* `collateralToken` can be ETH, WETH, BTC, LINK, UNI, USDC, USDT, DAI, FRAX.
*/
but doesn't account for USDT's non-standard approve/transferFrom implementation:
// In PerpetualVault.sol:
function deposit(uint256 amount) external payable nonReentrant {
// ...
collateralToken.safeTransferFrom(msg.sender, address(this), amount);
// ...
}
USDT has specific requirements:
Requires allowance to exactly match the transfer amount
Requires setting allowance to 0 before setting a new allowance
Will revert if allowance > transfer amount
This behavior is different from standard ERC20 tokens and can lead to failed deposits.
Impact:
Causes failed transactions and wasted gas fees
Affects protocol adoption due to USDT being a major stablecoin
Recommended Mitigation:
Add allowance validation check
Prize pool breakdown
Total prize
50,000 USDC
nSLOC
1,91026 USDC / LOC
47,500
2,500
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.