Submitted by devtooligan
When creating ERC20.sol from Solmate, a require() in permit() was converted to a custom error incorrectly.
It now reads:
So if the recoveredAddress is non-zero and the recoveredAddress is not owner it will error. But if the recoveredAddress == 0x0 then it will pass this check.
Anyone can permit themselves as a spender using the zero address for any token which inherits this ERC20 implementation.  So, for example, someone could redeem some zcTokens for underlying, then transfer the burned tokens back to themselves and repeat, draining the protocol.
JTraversa (Swivel) disagreed with severity and commented:
robrobbins (Swivel) resolved:
bghughes (judge) commented:
JTraversa (Swivel) commented:
0xean (judge) decreased severity to Medium and commented:
