Skip to content
This repository has been archived by the owner on Nov 26, 2023. It is now read-only.

0xRobocop - FootiumEscrow contract is vulnerable to erc20 approval race conditions #253

Closed
sherlock-admin opened this issue May 5, 2023 · 0 comments
Closed

0xRobocop - FootiumEscrow contract is vulnerable to erc20 approval race conditions #253

sherlock-admin opened this issue May 5, 2023 · 0 comments
Labels
Non-Reward This issue will not receive a payout

Comments

@sherlock-admin
Copy link
Contributor

sherlock-admin commented May 5, 2023 •
edited by github-actions bot
Loading

0xRobocop

medium

FootiumEscrow contract is vulnerable to erc20 approval race conditions

Summary

The setApprovalForERC20 function of the FootiumEscrow.sol contract is vulnerable to the ERC20 race condition approval vulnerability.

Vulnerability Detail

Details of the vulnerability can be found here

Impact

The vulnerability if exploited can cause the FootiumEscrow.sol contract to grant approval for a greater amount of tokens than the wanted.

Code Snippet

https://github.com/sherlock-audit/2023-04-footium/blob/main/footium-eth-shareable/contracts/FootiumEscrow.sol#L80

Tool used

Manual Review

Recommendation

Allow a function which the club owner can use increaseAllowance and decreaseAllowance

Duplicate of #8
@github-actions github-actions bot added High A valid High severity issue Duplicate A valid issue that is a duplicate of an issue with `Has Duplicates` label labels May 10, 2023
@sherlock-admin sherlock-admin added Medium A valid Medium severity issue Reward A payout will be made for this issue and removed High A valid High severity issue labels May 22, 2023
@sherlock-admin sherlock-admin added Non-Reward This issue will not receive a payout and removed Medium A valid Medium severity issue Duplicate A valid issue that is a duplicate of an issue with `Has Duplicates` label Reward A payout will be made for this issue labels Jun 12, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
Non-Reward This issue will not receive a payout
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@sherlock-admin