code-423n4 / 2021-12-yetifinance-findings

0 stars 0 forks source link

Unsafe approve in sYETIToken #286

Open code423n4 opened 2 years ago

code423n4 commented 2 years ago

Handle

0x1f8b

Vulnerability details

Impact

Unsafe approve was done.

Proof of Concept

In the method sYETIToken.buyBack it's made an approve without checking the boolean result, ERC20 standard specify that the token can return false if the approve was not made, so it's mandatory to check the result of approve methods.

Tools Used

Manual review

Recommended Mitigation Steps

Use safeApprove or check the boolean result

kingyetifinance commented 2 years ago

@LilYeti: Duplicate issue #19 and is severity level 0

alcueca commented 2 years ago

Not a duplicate

alcueca commented 2 years ago

Low severity is warranted, as the lack of return check can lead to incorrect state handling.