Licence contract's load() function will execute `transferFrom` on an arbitrary contract

tokencard / contracts

The Consumer Contract Wallet

GNU General Public License v3.0

94 stars 40 forks source link

Licence contract's load() function will execute `transferFrom` on an arbitrary contract #546

Closed draganm closed 4 years ago

draganm commented 4 years ago

Licence contract is not checking if the assed that is being loaded is supported and will execute transferFrom on any contract address passed as argument. We should introduce a check by consulting token whitelist before transferring ERC20

i-stam commented 4 years ago

duplicate of #547