search

code-423n4 / 2022-01-trader-joe-findings

2 stars 0 forks source link

Unchecked return value for `ERC20.approve` call #244

Closed code423n4 closed 2 years ago

code423n4 commented 2 years ago

Handle

WatchPug

Vulnerability details

There are many functions across the codebase that will perform an ERC20.approve() call but does not check the success return value. Some tokens do not revert if the approval failed but return false instead.

Instances include:

https://github.com/code-423n4/2022-01-trader-joe/blob/a1579f6453bc4bf9fb0db9c627beaa41135438ed/contracts/LaunchEvent.sol#L407-L408

        WAVAX.approve(address(router), wavaxReserve);
        token.approve(address(router), tokenAllocated);

It is usually good to add a require-statement that checks the return value or to use something like SafeERC20#safeIncreaseAllowance(); unless one is sure the given token reverts in case of a failure.

cryptofish7 commented 2 years ago

Duplicate of #154