search

code-423n4 / 2021-12-amun-findings

0 stars 0 forks source link

Approve 0 first #269

Open code423n4 opened 2 years ago

code423n4 commented 2 years ago

Handle

pauliax

Vulnerability details

Impact

Rebalance managers approve max if allowance < quantity. SingleTokenJoin, SingleTokenJoinV2, SingleNativeTokenExit, and SingleNativeTokenExitV2. approve max if allowance < balance.

The problem is that some tokens, e.g. USDT require resetting approval to 0 before approving any value again.

Recommended Mitigation Steps

Consider using this approach:

  token.approve(spender, 0);
  token.approve(spender, uint256(-1));