Astaria contest - tsvetanovv's results

Lines of code

https://github.com/code-423n4/2023-01-astaria/blob/main/src/ClearingHouse.sol#L148

Vulnerability details

Impact

Some tokens (like USDT) do not work when changing the allowance from an existing non-zero allowance value. They must first be approved by zero and then the actual allowance must be approved.

Proof of Concept

ClearingHouse.sol
148: ERC20(paymentToken).safeApprove(
149:      address(ASTARIA_ROUTER.TRANSFER_PROXY()),
150:      payment - liquidatorPayment
151:    );

Tools Used

Manual Review

Recommended Mitigation Steps

Use approve(0) to set the allowance to zero immediately before existing approve() calls.