wzrdk3lly - Approve function vulnerable to frontrunning attack

[sherlock-admin]

wzrdk3lly

medium

Approve function vulnerable to frontrunning attack

Summary

Approved escrow tokens are subject to front-run attack because the approve function doesn't account for an allowance already spent by the spender. In the event where the spender has spent the amount, the approve function will approve a new amount.

Vulnerability Detail

The spender can front-run new approvals and spend their current allowance + the new allowance granted by the token owner.

Let's take the example where Alice approves Bob the ability to spend an allowance of N tokens.

1. After approving Bob an allowance of N tokens, Alice decides she wants to change N to M.
2. Bob can front run the approve(M) transaction by first spending his N tokens, and then waiting until after approve(M) succeeds to spend an additional amount of M tokens.
3. In this scenario Bob has successfully taken N more tokens than Alice intended.

Impact

A user can steal another user's token by frontrunning approvals.

Code Snippet

https://github.com/sherlock-audit/2023-04-footium/blob/main/footium-eth-shareable/contracts/FootiumEscrow.sol#L75-L81

Tool used

Manual Review

Recommendation

The recommendation is to use OpenZeppelin's increaseAllowance and decreaseAllowance. See details here:

https://docs.openzeppelin.com/contracts/2.x/api/token/erc20#ERC20-increaseAllowance-address-uint256-
https://docs.openzeppelin.com/contracts/2.x/api/token/erc20#ERC20-decreaseAllowance-address-uint256-

Duplicate of #8