search

sherlock-audit / 2023-05-ironbank-judging

2 stars 2 forks source link

jprod15 - FlashLoan can be fail if token is USDT #377

Closed sherlock-admin closed 1 year ago

sherlock-admin commented 1 year ago

jprod15

medium

FlashLoan can be fail if token is USDT

Summary

Because the USDT token has a mechanism that requires the allowances to be equal to zero, the flash loan can fail.

Vulnerability Detail

The first time IERC20(token).safeApprove(ironBank, type(uint256).max); is executed, it will succeed because the allowance is zero. However,in the second time that the allowance is less than the amount, it will fail the because the allowance is not zero.

Impact

Code Snippet

https://github.com/sherlock-audit/2023-05-ironbank/blob/main/ib-v2/src/flashLoan/FlashLoan.sol#L107-L109

Tool used

Manual Review

Recommendation

add 

if (allowance < amount) {
    + IERC20(token).safeApprove(ironBank, 0);
        IERC20(token).safeApprove(ironBank, type(uint256).max);
    }