yAxis contest - jonah1005's results

Handle

jonah1005

Vulnerability details

Impact

The Alchemist.sol does not use safeApprove.

Alchemist.sol#L664-L669

    /// @dev sends tokens to the transmuter
    ///
    /// benefit of great nation of transmuter
    function _distributeToTransmuter(uint256 amount) internal {
        token.approve(transmuter, amount);
        ITransmuter(transmuter).distribute(address(this), amount);
        // lower debt cause of 'burn'
        xtoken.lowerHasMinted(amount);
    }

This would not work if the token contract is USDT. USDT only allows users to change the allowance from zero. USDT does not return any value in the approve function.

I consider this is a medium-risk issue.

Proof of Concept

Alchemist.sol#L727-L735

Tools Used

None

Recommended Mitigation Steps

    token.safeApprove(transmuter, 0);
    token.safeApprove(transmuter, amount);