code423n4 commented 1 year ago

Lines of code

https://github.com/code-423n4/2023-07-moonwell/blob/fced18035107a345c31c9a9497d0da09105df4df/src/core/MToken.sol#L159

Vulnerability details

Impact

The approve function overrides the ERC20 function and allows a user to approve someone else to spend tokens on their behalf. However, there are some tokens (LEND) that will revert if the allowance isn't set to zero before changing the allowance. Consider setting allowance to zero first as this is safer against front-running attacks and will also allow for tokens that need approve(0) to be set first.

Proof of Concept

        address src = msg.sender;
        transferAllowances[src][spender] = amount;
        emit Approval(src, spender, amount);
        return true;
    }

Tools Used

Manual review.

Recommended Mitigation Steps

        address src = msg.sender;
        transferAllowances[src][spender] = 0;
        transferAllowances[src][spender] = amount;
        emit Approval(src, spender, amount);
        return true;
    }