In above step, if we replace "factoryAddress" with another contract address, this can be a test or actual token address, minting does not happen but gas fee is used.
Tools Used
VS Code, rinkeby test network
Recommended Mitigation Steps
before approval check, if the contract is used for approval is the same as Factory contract
Handle
samruna
Vulnerability details
Impact
Token approval can be done from another contract. This can lead to drain of gas fee from the contract which is used to approve
Proof of Concept
const tokenAddress = (await deployments.get("ERC20Token")).address; const token = await ethers.getContractAt("ERC20Token", tokenAddress);
In above step, if we replace "factoryAddress" with another contract address, this can be a test or actual token address, minting does not happen but gas fee is used.
Tools Used
VS Code, rinkeby test network
Recommended Mitigation Steps