Submitted by 0x1f8b
FETH.sol#L212
Front running attack in approve.
The contract of the FETH does not have any protection against the well-known Multiple Withdrawal Attack attack on the Approve/TransferFrom methods of the ERC20 standard.
Although this attack poses a limited risk in specific situations, it is worth mentioning to consider it for possible future operations.
There are solutions to mitigate this front running such as, to first reduce the spenders allowance to 0 and set the desired value afterwards; another solution could the one that Open Zeppelin offers, where the non-standard decreaseAllowance and increaseAllowance functions have been added to mitigate the well-known issues involving setting allowances.
Add increase and decrease allowance.
NickCuso (Foundation) acknowledged and commented:
