The GraphTokenUpgradeable.permit() function ignores the recoveredAddress != 0 check if isApprovedForAll[owner][recoveredAddress] is true. If a user accidentally set the zero address as the operator, tokens can be stolen by anyone as a wrong signature yield recoveredAddress == 0.
Tools Used
Manual Review
Recommended Mitigation Steps
Change the require logic to recoveredAddress != address(0) && (recoveredAddress == owner) || isApprovedForAll[owner][recoveredAddress]).
Lines of code
https://github.com/code-423n4/2022-10-thegraph/blob/main/contracts/l2/token/GraphTokenUpgradeable.sol#L94
Vulnerability details
Impact
The
GraphTokenUpgradeable.permit()
function ignores therecoveredAddress != 0
check ifisApprovedForAll[owner][recoveredAddress]
is true. If a user accidentally set the zero address as the operator, tokens can be stolen by anyone as a wrong signature yieldrecoveredAddress == 0
.Tools Used
Manual Review
Recommended Mitigation Steps
Change the require logic to
recoveredAddress != address(0) && (recoveredAddress == owner) || isApprovedForAll[owner][recoveredAddress])
.