Submitted by cmichel
The setToken function performs an ERC20.approve() call but does not check the success return value.
Some tokens do not revert if the approval failed but return false instead.
The impact is that tokens that dont actually perform the approve and return false are still counted as a correct approve.
We recommend using OpenZeppelins SafeERC20 versions with the safeApprove function that handles the return value check as well as non-standard-compliant tokens.
jeffywu (Notional) confirmed
