Open code423n4 opened 2 years ago
Never been a fan of these reports, but i'll leave it to the judges. We just used the minimalistic solmate ERC20 implementation and in general the increase/decrease isnt a factor for our zcToken in comparison to approve.
Never been a fan of these reports, but i'll leave it to the judges. We just used the minimalistic solmate ERC20 implementation and in general the increase/decrease isnt a factor for our zcToken in comparison to approve.
Agreed, this is QA at best IMO and the user is referencing an idea that applies to ERC20 globally
Warden did not submit QA so this will act as their primary QA report.
may as well label this
"Use of ERC20"
Lines of code
https://github.com/code-423n4/2022-07-swivel/blob/main/Tokens/Erc20.sol#L78-L84
Vulnerability details
Impact
А possible attack scenario:
So, an Alice's attempt to change the Bob's allowance from N to M (N>0 and M>0) made it possible for Bob to transfer N+M of Alice's tokens, \ while Alice never wanted to allow so many of her tokens to be transferred by Bob.
Proof of Concept
https://github.com/code-423n4/2022-07-swivel/blob/main/Tokens/Erc20.sol#L78-L84
Tools Used
editor
Recommended Mitigation Steps
Add
decreaseAllowance
andincreaseAllowance
functions on the custom ERC20 implementation.