Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

ERC20Permit Implementation in non-transferable token

holydevoti0n

Summary

The DebtToken implements both EIP-2612 (ERC20Permit) and standard ERC20 approval functions despite having all transfers blocked. This allows users to set allowances and generate permit signatures that can never be utilized, while also potentially misleading integrators who rely on standard ERC20 approval mechanisms.

Impact

The contract allows users to set allowances and generate valid EIP-2612 signatures that can never be utilized, while exposing integrating protocols to potential malfunctions due to failed transferFrom operations after successful approvals

Tools Used

Manual Review

Aave Debt Token:

Recommendations

Remove the inheritance from ERC20Permit and add revert for any approval-related function:

- contract DebtToken is ERC20, ERC20Permit, IDebtToken, Ownable {
+ contract DebtToken is ERC20, IDebtToken, Ownable {
+
+ function allowance(address owner, address spender)
+ public
+ view
+ virtual
+ override
+ returns (uint256)
+ {
+ owner;
+ spender;
+ revert('ALLOWANCE_NOT_SUPPORTED');
+ }
+
+
+ function approve(address spender, uint256 amount) public virtual override returns (bool) {
+ spender;
+ amount;
+ revert('APPROVAL_NOT_SUPPORTED');
+ }
+
+
+ function increaseAllowance(address spender, uint256 addedValue)
+ public
+ virtual
+ override
+ returns (bool)
+ {
+ spender;
+ addedValue;
+ revert('ALLOWANCE_NOT_SUPPORTED');
+ }
+
+
+ function decreaseAllowance(address spender, uint256 subtractedValue)
+ public
+ virtual
+ override
+ returns (bool)
+ {
+ spender;
+ subtractedValue;
+ revert('ALLOWANCE_NOT_SUPPORTED');
+ }
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.