Submitted by hihen, also found by 0xsomeone
It is still possible for a blacklisted users bond token to be approved.
KUMABondToken.approve() only checks if msg.sender and to are not blacklisted. It doesnt check if the owner of the tokenId is not blacklisted.
For example, the following scenario allows a blacklisted users bond token to be approved:
VS Code
KUMABondToken.approve() should revert if the owner of the tokenId is blacklisted:
Alex the Entreprenerd (judge) commented:
m19 (KUMA) confirmed and commented:
m19 (KUMA) mitigated:
