code-423n4 / 2021-09-wildcredit-findings

0 stars 0 forks source link

Race condition on ERC20 approval #120

Open code423n4 opened 2 years ago

code423n4 commented 2 years ago

Handle

tensors

Vulnerability details

Using approve() to manage allowances opens yourself and users of the token up to frontrunning. Best practice, but doesn't usually matter.

https://github.com/code-423n4/2021-09-wildcredit/blob/c48235289a25b2134bb16530185483e8c85507f8/contracts/LPTokenMaster.sol#L87

See also: https://github.com/0xProject/0x-monorepo/issues/850

I recommend using increase/decreaseAllowance instead.