The Gov contract uses the SafeERC20 library to handle the transfer of tokens that are not compliant with the ERC20 specification. However, in line 300, the approve function is used instead of the safeApprove function. Tokens not compliant with the ERC20 specification could return false from the approve call to indicate the approval fails, while the calling contract would not notice the failure if the return value is not checked.
Use safeApprove instead of approve, which reverts the transaction with a proper error message when the return value of approve is false. A better approach is to use safeIncreaseAllowance instead, which mitigates the multiple withdrawal attack on ERC20 tokens.
Handle
shw
Vulnerability details
Impact
The
Gov
contract uses theSafeERC20
library to handle the transfer of tokens that are not compliant with the ERC20 specification. However, in line 300, theapprove
function is used instead of thesafeApprove
function. Tokens not compliant with the ERC20 specification could returnfalse
from theapprove
call to indicate the approval fails, while the calling contract would not notice the failure if the return value is not checked.Proof of Concept
Referenced code: Gov.sol#L300
Recommended Mitigation Steps
Use
safeApprove
instead ofapprove
, which reverts the transaction with a proper error message when the return value ofapprove
isfalse
. A better approach is to usesafeIncreaseAllowance
instead, which mitigates the multiple withdrawal attack on ERC20 tokens.