Token-0x
First Flight #54
Beginner FriendlyDeFi
100 EXP
View all submissions
Previous Next
Submission Details
Impact: high
Likelihood: medium

Potential double spending in "_approve" function

Author Revealed upon completion

Root + Impact

Description

  • The function _approve could cause the issue of double spending. In a certain moment an spender could use all or part of the funds and in just that moment the approver sets a new limit of allowance overwritting the previous. In this way the spender could use more funds than desired.

function _approve(address owner, address spender, uint256 value) internal virtual returns (bool success) {
assembly ("memory-safe") {
if iszero(owner) {
mstore(0x00, shl(224, 0xe602df05))
mstore(add(0x00, 4), owner)
revert(0x00, 0x24)
}
if iszero(spender) {
mstore(0x00, shl(224, 0x94280d62))
mstore(add(0x00, 4), spender)
revert(0x00, 0x24)
}
​
let ptr := mload(0x40)
let baseSlot := _allowances.slot
​
mstore(ptr, owner)
mstore(add(ptr, 0x20), baseSlot)
let initialHash := keccak256(ptr, 0x40)
mstore(ptr, spender)
mstore(add(ptr, 0x20), initialHash)
​
let allowanceSlot := keccak256(ptr, 0x40)
//audit: instead of overwritting the allowance. The allowance could be increased/decreased
@> sstore(allowanceSlot, value)
​
success := 1
mstore(0x00, value)
log3(0x00, 0x20, 0x8c5be1e5ebec7d5bd14f71427d1e84f3dd0314c0f7b2291e5b200ac8c7c3b925, owner, spender)
}
}

Risk

Likelihood:

  • Medium. It is not that easy a user could spend at the same moment that the approver is setting a new allowance. But could happen if the spender monitorize the transactions.

Impact:

  • High. The spender could use more funds that intended by the approver.

Proof of Concept

  • The user sets a limit of allowance. Let's say 2 ETH.

  • The spender uses 1 ETH of 2.

  • At the same moment the approver sets a new limit of 3 ETH.

  • As consequence, the spender could potentially spend 4 ETH (one ETH spent already, and the 3 set as a new limit)

Recommended Mitigation

  • Instead of using _approve function. Could be created the functions increaseAllowance and decreaseAllowance.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!