code-423n4 / 2021-10-union-findings

0 stars 0 forks source link

Gas: `CompoundAdapter` should approve `cToken` addresses once #73

Closed code423n4 closed 3 years ago

code423n4 commented 3 years ago

Handle

cmichel

Vulnerability details

The CompoundAdapter approves the cTokenAddress each time deposit is called. It's more gas efficient to approve it only once with the max value - AaveAdapter is already doing this.

GalloDaSballo commented 3 years ago

Disagree with the finding as setting back the value to zero twice should issue a gas refund (this gas refund math has changed recently), cannot accept the finding at face value without some references to the gas math