Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: M-04 Some Contracts Might Not Work Properly with USDT Allowance #734

Merged
merged 4 commits into from
Nov 14, 2024

Conversation

bmzig
Copy link
Contributor

@bmzig bmzig commented Nov 8, 2024

The ERC7683OrderDepositorExternal contract implements the _deposit function to finalize the creation of an Across V3 deposit. To do so, the function calls the safeIncreaseAllowance function on the inputToken specified in the order details. This mechanism will work with any token under the assumption that the entire allowance will be spent by the SpokePool in the depositV3 function call. The safeIncreaseAllowance function is also used in the ZkStack_Adapter and the ZkStack_CustomGasToken_Adapter contracts, along with some other adapters like the ZkSync_Adapter which are out of scope for this audit.

However, if for any reason, the entire allowance is not used after the approval, any further attempt to safeIncreaseAllowance with tokens that prohibit any approval change from non-zero to non-zero values, like USDT, will ultimately fail. As an example of a real impact, the second example of issue M08 will likely produce a scenario in which subsequent calls with USDT as the custom gas token will fail, thus blocking the entire ZkStack_CustomGasToken_Adapter's functionality.

Consider using the forceApprove function of the SafeERC20 library to be compatible with tokens that revert on approvals from non-zero to non-zero values.

This swaps safeIncreaseAllowance with forceApprove in ERC7683OrderDepositorExternal.sol.

bmzig added 2 commits November 8, 2024 11:07
Signed-off-by: bennett <bennett@umaproject.org>
Signed-off-by: bennett <bennett@umaproject.org>
@bmzig bmzig marked this pull request as ready for review November 14, 2024 14:35
@bmzig bmzig merged commit d2b2b98 into master Nov 14, 2024
9 checks passed
@bmzig bmzig deleted the 1124oz/m04 branch November 14, 2024 20:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants