Upgraded Q -> 2 from #538 [1727786260314]

[c4-judge]

Judge has assessed an item in Issue #538 as 2 risk. The relevant finding follows:

🔵 L02 - vulnerable to permit front-run causing a revert
https://github.com/code-423n4/2024-07-loopfi/blob/main/src/proxy/TransferAction.sol#L67-L67

Vulnerability details
When calling a permit, the data of the permit will be logged in the blockchain, and anyone is able to frontrun the permit by duplicating the TX arguments. This is not an issue according to the EIP since the permit creator can just create another permit.

However, if the permit is used in conjunction with an external function call, frontrunning the permit will cause the function to be griefed.

This is what’s hapenning in TransferAction::_transferFrom:

File: src/proxy/TransferAction.sol
46: function _transferFrom(
47: address token,
48: address from,
49: address to, //! to is not part of the permit signature
50: uint256 amount,
51: PermitParams memory params
52: ) internal {
...:
...: //* ------ some code ----- //
...:
65: } else if (params.approvalType == ApprovalType.PERMIT) {
66: // Consume a standard ERC20 permit message
67: IERC20Permit(token).safePermit(
68: from,
69: to,
70: params.approvalAmount,
71: params.deadline,
72: params.v,
73: params.r,
74: params.s
75: );
76: IERC20(token).safeTransferFrom(from, to, amount);
77: } else {
...:
...: // ------ some code ----- *//
...:
81: }
Impact
User actions can be DoS’d repeatedly by a malicious actor.

[c4-judge]

koolexcrypto marked the issue as duplicate of #205

[c4-judge]

koolexcrypto marked the issue as satisfactory