Submitted by 0x1f8b, also found by 0xNineDec and StErMi
The security of the Yieldy contract is delegated to the compiler used.
The allowance of an account does not have to reflect the real balance of an account, however in the transferFrom method, it is the value that is checked in order to verify that the user has enough balance to make the transfer.
However, the real balance of the Yieldy contract is based on the calculation made by the creditsForTokenBalance method, so an underflow could be made in the subtraction of the balance of the from account.
This means that the security of the contract is delegated to the checks added by the compiler depending on the pragma used, it must be taken into account that these checks may appear and disappear in future versions of the compiler, so they must be checked at the level of smart contracts.
Affected source code:
toshiSat (Yieldy) confirmed and commented:
toshiSat (Yieldy) resolved:
