Submitted by Soosh, also found by 0x52, 0xDjango, cccz, saian, TerrierLover, WatchPug, and zzzitron
https://github.com/Plex-Engineer/lending-market/blob/755424c1f9ab3f9f0408443e6606f94e4f08a990/contracts/WETH.sol#L85
Allows anyone to steal all wrapped manifest from the WETH.sol contract. Attacker can also withdraw
to convert Wrapped Manifest to Manifest.
Issue in approve(address owner, address spender) external function. This allows an attacker to approve themselves to spend another users tokens.
Attacker can then use transferFrom(address src, address dst, uint wad) function to send tokens to themself.
See wardens full report for further details.
VScode, hardhat
I believe there is no need for this function. There is another approve(address guy, uint wad) function that uses msg.sender to approve allowance. There should be no need for someone to approve another users allowance.
Remove the approve(address owner, address spender) function.
tkkwon1998 (Canto) confirmed
Alex the Entreprenerd (judge) commented:
