CosmWasm / cw-plus

Production Quality contracts under open source licenses
Apache License 2.0
504 stars 353 forks source link

Consider Handling of Updating Expired Allowances in CW20 Contract #909

Open yuxuan-xie opened 2 months ago

yuxuan-xie commented 2 months ago

Hi Team,

I've encountered an issue when working with the IncreaseAllowance and DecreaseAllowance message and updating expired allowances.

Currently, if I assign an allowance to a spender with an expiration(i.e, valid for 10 blocks), and the spender does not use up this allowance by the time it expires, the expired amount of tokens is still considered when I increase the allowance for the same spender later on. The same is true for decreasing the allowance of the spender with a valid expiration. This results in the spender having a higher amount of valid tokens than intended.

Illustrative example:

  1. Owner A assigns an allowance of 100 tokens to Spender B, valid for 10 blocks.
  2. Spender B does not use the allowance, and it expires.
  3. Owner A then need to assign an additional allowance of 100 tokens to Spender B
  4. Therefore, Owner A uses IncreaseAllowance message and assigns the second allowance of 100 tokens.
  5. However, Spender B now has access to 200 tokens, not 100. The expired allowance has been effectively revived.

I understand that owner can query the actual allowance before increasing or decreasing it to decide the proper amount. However, from my opinion, it would be more logical and intuitive for the expired allowance to be discarded.

One possible solution might be having default allowance if the allowance is expired.

I would love to hear your thoughts on this. Would you consider this as a viable improvement for the CW20 contract?