Submitted by 0xpiken, also found by SpicyMeatball
The function ASDRouter#lzCompose() never succeeds. The receiver can only receive ASDUSDC token when the call of ASDRouter#lzCompose() is done.
ASDRouter#lzCompose() is used to deposit wrapped USDC token for ASD token:
However, in the second step, ASDUSDC.approve() was not invoked to authorize crocSwapAddress to spend their ASDUSDC. Consequently, crocSwapAddress#swap() cannot successfully swap ASDUSDC for NOTE. _swapOFTForNote() will fail and all ASDUSDC will be refunded to the designated receiver.
To demonstrate the aforementioned issue, the POC is divided into two parts:
Run npx hardhat test. From the log we can see that the allowance is 0, while the ASDUSDC balance of ASDRouter is not:
Create test/DEX.js:
Open one terminal to run npx hardhat node, then open another terminal to run npx hardhat test. Its obvious that dex.swap() will fail if usdc.approve() is not called first.
Set allowance to the maximum value from the beginning:
Context
dsudit01 (Canto) confirmed and commented:
SpicyMeatball (warden) commented:
3docSec (judge) commented:
