Submitted by nobody2018
In the bot-report.md for [M-04] Return values of approve() not checked, it describes that by not checking the return value, operations that should have marked as failed, may potentially go through without actually approving anything, but the following contents of this submission is different.
If the tokens approve does not return a value, like USDT, then ERC20(_token).approve will revert. Because ERC20 comes from solmate/tokens/ERC20.sol, its approve is defined as function approve(address spender, uint256 amount) public virtual returns (bool) where the return value is bool type with a size of 1 byte. The bytecode compiled by the solidity compiler from ERC20(_token).approve will check whether the return size is 1 byte. If not, revert will occur.
This will cause all functions calling _transferAndApproveToken to revert. This includes callOutAndBridge and callOutAndBridgeMultiple.
L175, the compiled code of ERC20(_token).approve(_localPortAddress, _deposit) is similar to the following:
Copy the coded POC below to one project from Foundry and run forge test -vvvto prove this issue:
Use safeApprove from solady/utils/SafeTransferLib.sol.
DoS
alcueca (judge) commented:
nobody2018 (warden) commented:
alcueca (judge) commented:
0xBugsy (Maia) commented:
0xBugsy (Maia) confirmed
