Core Contracts

Summary

Approving curveVault without resetting the allowance could allow residual usage in the RAAC protocol.

Vulnerability Details

When approving curveVault, not resetting the allowance first could leave residual allowances that might be exploited if the vault turns malicious.

Impact

This issue poses a low risk but could lead to unauthorized token transfers if a malicious vault takes advantage of the residual allowances.

Tools Used

• Manual review

Recommendations

Use safeIncreaseAllowance in vault interactions to manage allowances securely.