Using transfer instead of approve in OptimismPortal

tokamak-network / tokamak-thanos

MIT License

7 stars 3 forks source link

Using transfer instead of approve in OptimismPortal #252

Closed nguyenzung closed 1 month ago

nguyenzung commented 2 months ago

SEREViTY: MEDIUM

IMPACT: a withdrawal transaction can be finalized with unexpected amount

steven94kr commented 2 months ago

I think it's a great idea. We can prevent to manipulate other target's allowance in the Portal! Because L1CDM's relayMessage permits only the Portal Contract, I think it makes sense!

nguyenzung commented 1 month ago

As what discussed with @rlgns98kr , we can close this issue and waiting for the discussion with the audit team in the external audit