The logic around the decrementing the allowance in the withdraw and redeem methods of the contract ZcToken are wrong implemented and cannot be used.
Proof of Concept
There are a Denial of Service in the withdraw and redeem methods of the ZcToken contract, the allowance is checked in the opposite way, so if the allowed amount is greater or equal to the amount, it will be reverted, otherwise, an integer overflow will also revert the execution.
Lines of code
https://github.com/code-423n4/2022-07-swivel/blob/fd36ce96b46943026cb2dfcb76dfa3f884f51c18/Creator/ZcToken.sol#L132-L134 https://github.com/code-423n4/2022-07-swivel/blob/fd36ce96b46943026cb2dfcb76dfa3f884f51c18/Creator/ZcToken.sol#L111-L115
Vulnerability details
Impact
The logic around the decrementing the
allowance
in thewithdraw
andredeem
methods of the contractZcToken
are wrong implemented and cannot be used.Proof of Concept
There are a Denial of Service in the
withdraw
andredeem
methods of theZcToken
contract, the allowance is checked in the opposite way, so if theallowed
amount is greater or equal to the amount, it will be reverted, otherwise, an integer overflow will also revert the execution.Recommended Mitigation Steps