search

code-423n4 / 2021-07-sherlock-findings

0 stars 0 forks source link

Unsafe implementation of `decreaseApproval` of `SherXERC20` #142

Closed code423n4 closed 3 years ago

code423n4 commented 3 years ago

Handle

shw

Vulnerability details

Impact

The decreaseApproval method of SherXERC20 is considered unsafe since the allower has no trivial way to know whether the spender transferred any number of tokens from him before a decreaseApproval call is executed. Please refer to the following link for more details.

Proof of Concept

Referenced code: SherXERC20.sol#L79-L83

OpenZeppelin/openzeppelin-contracts - Method decreaseApproval in unsafe

Recommended Mitigation Steps

Consider using increaseAllowance and decreaseAllowance instead. Besides, increaseApproval and decreaseApproval are replaced in the OpenZeppelin library in this commit.

Evert0x commented 3 years ago

117

ghoul-sol commented 3 years ago

Duplicate of #117 so low risk