Open sherlock-admin2 opened 1 week ago
shaflow01
Medium
The contract should immediately revoke the authorization, rather than waiting for the next interaction.
https://github.com/sherlock-audit/2024-11-telcoin/blob/main/telcoin-audit/contracts/swap/AmirX.sol#L195
No response
The allowance is not immediately cleared after calling the aggregator swap.
Malicious users can abuse the allowance by using part of the aggregator functions.
A malicious user could manipulate the aggregator to exploit the allowance.
The contract should immediately revoke all allowances after the swap is completed.
shaflow01
Medium
The contract should immediately revoke the authorization, rather than waiting for the next interaction.
Summary
The contract should immediately revoke the authorization, rather than waiting for the next interaction.
Root Cause
https://github.com/sherlock-audit/2024-11-telcoin/blob/main/telcoin-audit/contracts/swap/AmirX.sol#L195
Internal pre-conditions
No response
External pre-conditions
No response
Attack Path
The allowance is not immediately cleared after calling the aggregator swap.
Malicious users can abuse the allowance by using part of the aggregator functions.
Impact
A malicious user could manipulate the aggregator to exploit the allowance.
PoC
No response
Mitigation
The contract should immediately revoke all allowances after the swap is completed.