code-423n4 / 2021-12-defiprotocol-findings

0 stars 0 forks source link

`safeApprove` is deprecated #151

Closed code423n4 closed 2 years ago

code423n4 commented 2 years ago

Handle

gzeon

Vulnerability details

Impact

safeApprove is deprecated, see https://github.com/OpenZeppelin/openzeppelin-contracts/blob/566a774222707e424896c0c390a84dc3c13bdcb2/contracts/token/ERC20/utils/SafeERC20.sol#L38

Proof of Concept

$grep "safeApprove" -R -n ./contracts 
./contracts/Factory.sol:112:            token.safeApprove(address(newBasket), bProposal.weights[i]);
./contracts/Basket.sol:276:            IERC20(tokens[i]).safeApprove(spender, 0);
./contracts/Basket.sol:277:            IERC20(tokens[i]).safeApprove(spender, type(uint256).max);

frank-beard commented 2 years ago

https://github.com/code-423n4/2021-12-defiprotocol-findings/issues/177