There exist ERC20 tokens that made certain customizations to their contract.
One type of these tokens is deflationary tokens that charge a certain fee for every transfer() or transferFrom().
The Swap.swapByQuote function performs a safeTransferFrom(msg.sender, this, amountToSell) and then approves the same amountToSell which will be more than what the Swap contract actually received due to fees.
Impact
The zrxAllowanceTarget contract is allowed to transfer more than what was transferred to the contract post fees.
If the Swap contract accumulated swap fees in this token, part of them (amountToSell - amountToSellPostFees) can be stolen/are allowed to be transferred from the Swap contract.
Recommended Mitigation Steps
One possible mitigation is to measure the asset change right before and after the asset-transferring IERC20(zrxSellTokenAddress).safeTransferFrom(msg.sender, address(this), amountToSell) call, and then only approve the zrxAllowanceTarget with the difference.
Handle
cmichel
Vulnerability details
There exist ERC20 tokens that made certain customizations to their contract. One type of these tokens is deflationary tokens that charge a certain fee for every
transfer()
ortransferFrom()
.The
Swap.swapByQuote
function performs asafeTransferFrom(msg.sender, this, amountToSell)
and then approves the sameamountToSell
which will be more than what the Swap contract actually received due to fees.Impact
The
zrxAllowanceTarget
contract is allowed to transfer more than what was transferred to the contract post fees. If theSwap
contract accumulated swap fees in this token, part of them (amountToSell - amountToSellPostFees
) can be stolen/are allowed to be transferred from the Swap contract.Recommended Mitigation Steps
One possible mitigation is to measure the asset change right before and after the asset-transferring
IERC20(zrxSellTokenAddress).safeTransferFrom(msg.sender, address(this), amountToSell)
call, and then only approve thezrxAllowanceTarget
with the difference.