Liquidity Management
Gamma
DeFiFoundry
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Deprecated `SafeERC20.safeApprove()` Usage [Potential Token Approval Failures]

oks_oks

Summary

The contract uses OpenZeppelin's deprecated safeApprove() function in multiple locations, which can lead to failed transactions and potential token approval issues.

Vulnerability Details

In GmxProxy.sol, the contract uses the deprecated safeApprove() function:

function createOrder(Order.OrderType orderType, IGmxProxy.OrderData memory orderData) public returns (bytes32) {
// ...
if (orderType == Order.OrderType.MarketSwap || orderType == Order.OrderType.MarketIncrease) {
@> IERC20(orderData.initialCollateralToken).safeApprove(address(gmxRouter), orderData.amountIn);
// ...
}
}

Similarly in ParaSwap.sol:

@> IERC20(fromToken).safeApprove(approvalAddress, fromAmount);

The safeApprove() function has been deprecated by OpenZeppelin due to known issues with certain tokens. It can fail when:

  1. Trying to change an existing non-zero approval

  2. Working with tokens that don't revert on failed approvals

Impact

  • Failed transactions due to approval issues

  • Potential blocking of critical operations

  • Unnecessary gas consumption from failed transactions

  • Possible permanent blocking of token approvals requiring contract redeployment

https://github.com/code-423n4/2024-07-reserve-validation/issues/175

Recommendations

Replace safeApprove() with safeIncreaseAllowance() or safeDecreaseAllowance():

// Use safeIncreaseAllowance
function createOrder(Order.OrderType orderType, IGmxProxy.OrderData memory orderData) public returns (bytes32) {
if (orderType == Order.OrderType.MarketSwap || orderType == Order.OrderType.MarketIncrease) {
- IERC20(orderData.initialCollateralToken).safeApprove(address(gmxRouter), orderData.amountIn);
+ IERC20(orderData.initialCollateralToken).safeIncreaseAllowance(address(gmxRouter), orderData.amountIn);
// ...
}
}
Updates

Lead Judging Commences

n0kto Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

invalid_safeApprove_no_reset

USDT or other unusual ERC20 tokens: out of scope. For the other reports: No proof that the allowance won't be consumed by the receiver.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!