Liquidity Management
Gamma
DeFiFoundry
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

safeApprove() should be replaced with safeIncreaseAllowance() in ParaSwapUtils.sol#L23

zhanmingjing

Summary

safeApprove() should be replaced with safeIncreaseAllowance() in ParaSwapUtils.sol#L23

Vulnerability Details

IERC20.approve() has risks.

Beware that changing an allowance with this method brings the risk that someone may use both the old and the new allowance by unfortunate transaction ordering. One possible solution to mitigate this race condition is to first reduce the spender’s allowance to 0 and set the desired value afterwards:

https://github.com/ethereum/EIPs/issues/20#issuecomment-263524729

According to :

https://docs.openzeppelin.com/contracts/4.x/api/token/erc20#SafeERC20-safeApprove-contract-IERC20-address-uint256-

safeApprove() is Deprecated. This function has issues similar to the ones found in IERC20.approve, and its usage is discouraged.

Whenever possible, use safeIncreaseAllowance and safeDecreaseAllowance instead.

Impact

Deprecated function safeApprove() should not be used

Tools Used

manually reviewed

Recommendations

replace safeApprove() with safeIncreaseAllowance() in function ParaSwapUtils.sol#swap()

function swap(address to, bytes memory callData) external {
_validateCallData(to, callData);
address approvalAddress = IAugustusSwapper(to).getTokenTransferProxy();
address fromToken;
uint256 fromAmount;
assembly {
fromToken := mload(add(callData, 68))
fromAmount := mload(add(callData, 100))
}
IERC20(fromToken).safeIncreaseAllowance(approvalAddress, fromAmount);
(bool success, ) = to.call(callData);
require(success, "paraswap call reverted");
}
Updates

Lead Judging Commences

n0kto Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational or Gas

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelihood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.