Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ElasticReceiptTokenBase_v1.increaseAllowance lacks of validRecipient modifier #140

Open
hats-bug-reporter bot opened this issue Jun 16, 2024 · 1 comment
Labels
bug Something isn't working Invalid - Lead Auditor invalid This doesn't seem right

Comments

@hats-bug-reporter
Copy link

Github username: --
Twitter username: --
Submission hash (on-chain): 0xdfafe3bb77118d9c96ff1b19049bed1aafc6c4b1c63c2e825604c7c73860a909
Severity: low

Description:
Description
ElasticReceiptTokenBase_v1.increaseAllowance and ElasticReceiptTokenBase_v1.approve have sililar function that add/set _tokenAllowances.
For ElasticReceiptTokenBase_v1.approve, the function uses validRecipient, but increaseAllowancedoesn't use validRecipient.

Attack Scenario
Without the validRecipient, ElasticReceiptTokenBase_v1.increaseAllowance can be used to set _tokenAllowances to address(0) or address(this)

Attachments

  1. Proof of Concept (PoC) File
  1. Revised Code File (Optional)
@hats-bug-reporter hats-bug-reporter bot added the bug Something isn't working label Jun 16, 2024
@PlamenTSV
Copy link

Informational, no value loss.

@FHieser FHieser added the invalid This doesn't seem right label Jun 26, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working Invalid - Lead Auditor invalid This doesn't seem right
Projects
None yet
Development

No branches or pull requests

2 participants