Submitted by MiloTruck, also found by Limbooo
According to the README, when an address has token guardian enabled, approvals should not work for the tokens owned by that address:
In LensHandles.sol, token guardian is enforced by the _hasTokenGuardianEnabled() check in the approve() function:
LensHandles.sol#L139-L145
However, this check is inadequate as approved operators (addresses approved using setApprovalForAll() by the owner) are also allowed to call approve(). We can see this in Openzeppelins ERC-721 implementation:
ERC721.sol#L116-L119
As such, even if an owner has token guardian enabled, approvals can still be set for his tokens by other approved operators, leaving the owners tokens vulnerable. For example:
Note that the approve() function in LensProfiles.sol also has the same vulnerability.
As token guardian protection in approve() does not account for approved operators, although an owner has token guardian enabled, approved operators will still be able to set approvals for his tokens.
The following Foundry test demonstrates the example above:
Consider checking if the tokens owner has token guardian enabled as well:
LensHandles.sol#L139-L145
Access Control
donosonaumczuk (Lens) commented via duplicate issue #90:
