Submitted by hyh, also found by cccz, berndartmueller, delfin454000, joestakey, robee, defsec, and 0xDjango
https://github.com/code-423n4/2022-04-mimo/blob/b18670f44d595483df2c0f76d1c57a7bfbfbc083/supervaults/contracts/SuperVault.sol#L320-L326
https://github.com/code-423n4/2022-04-mimo/blob/b18670f44d595483df2c0f76d1c57a7bfbfbc083/supervaults/contracts/SuperVault.sol#L198-L199
leverageSwap and emptyVaultOperation can be run repeatedly for the same tokens. If these tokens happen to be an ERC20 that do not allow for approval of positive amount when allowance already positive, both functions can become stuck.
https://github.com/d-xo/weird-erc20#approval-race-protections
In both cases, logic doesnt seem to guarantee full usage of the allowance given. If its not used fully, the token will revert each next approve attempt, which will render the functions unavailable for the token.
While emptyVaultOperation can be cured by emptying the balance and rerun, in the leverageSwap case there is no such fix possible.
Setting severity to medium as this clearly impacts leverageSwap and emptyVaultOperation availability to the users.
leverageSwap calls target token for maximum approval of core each time:
https://github.com/code-423n4/2022-04-mimo/blob/b18670f44d595483df2c0f76d1c57a7bfbfbc083/supervaults/contracts/SuperVault.sol#L320-L326
Some tokens do not have maximum amount as an exception, simply reverting any attempt to approve positive from positive, for example current USDT contract, L205:
https://etherscan.io/address/0xdac17f958d2ee523a2206206994597c13d831ec7#code
I.e. if leverageSwap be run again with USDT it will revert all the times after the first.
emptyVaultOperation approves core for the whole balance of stablex:
https://github.com/code-423n4/2022-04-mimo/blob/b18670f44d595483df2c0f76d1c57a7bfbfbc083/supervaults/contracts/SuperVault.sol#L198-L199
Consider adding zero amount approval before actual amount approval, i.e. force zero allowance before current approval.
m19 (Mimo DeFi) acknowledged
gzeoneth (judge) commented:
