Delegate - kodyvim's results

Lines of code

https://github.com/code-423n4/2023-09-delegate/blob/main/src/libraries/DelegateTokenTransferHelpers.sol#L35

Vulnerability details

Impact

Strict allowance could affect third party integration

Proof of Concept

Protocols or third party integration seeking to build on delegate could be unable upon to create() with approved NFT tokens. These integrations might not necessarily need to transfer the nft from the user. When creating a delegate position: checkAndPullByType -> checkERC721BeforePull is called. https://github.com/code-423n4/2023-09-delegate/blob/main/src/libraries/DelegateTokenTransferHelpers.sol#L35

function checkERC721BeforePull(uint256 underlyingAmount, address underlyingContract, uint256 underlyingTokenId) internal view {
        if (underlyingAmount != 0) {
            revert Errors.WrongAmountForType(IDelegateRegistry.DelegationType.ERC721, underlyingAmount);
        }
        if (IERC721(underlyingContract).ownerOf(underlyingTokenId) != msg.sender) {//<@
            revert Errors.CallerNotOwnerOrInvalidToken();
        }
    }

because it strictly checks that the owner is the caller and does not allow from approved users, any approved user call to create would fail.

Tools Used

Manual Review

Recommended Mitigation Steps

Consider allowing both the owners or approved users to create delegate using the NFT.

Assessed type

Context