ERC20 approve method missing return value check

[code423n4]

Handle

defsec

Vulnerability details

Impact

The lock, _buyMochi, claimRewardAsMochi, _buyCRV, _lockCRV functions perform an ERC20.approve() call but does not check the success return value. Some tokens do not revert if the approval failed but return false instead.

Proof of Concept

1. Navigate to "https://github.com/Swivel-Finance/gost/blob/v2/test/swivel/Swivel.sol#L109"
2. The lock, _buyMochi, claimRewardAsMochi, _buyCRV, _lockCRV functions use an approve method.
3. Tokens that don't actually perform the approve and return false are still counted as a correct approve.

Code Locations

https://github.com/code-423n4/2021-10-mochi/blob/main/projects/mochi-core/contracts/treasury/MochiTreasuryV0.sol#L86

https://github.com/code-423n4/2021-10-mochi/blob/main/projects/mochi-core/contracts/treasury/MochiTreasuryV0.sol#L97

https://github.com/code-423n4/2021-10-mochi/blob/main/projects/mochi-core/contracts/feePool/FeePoolV0.sol#L69

https://github.com/code-423n4/2021-10-mochi/blob/main/projects/mochi-core/contracts/feePool/ReferralFeePoolV0.sol#L34

https://github.com/code-423n4/2021-10-mochi/blob/main/projects/mochi-core/contracts/emission/VestedRewardPool.sol#L55

Tools Used

None

Recommended Mitigation Steps

Its recommend to using OpenZeppelin’s SafeERC20 versions with the safeApprove function that handles the return value check as well as non-standard-compliant tokens.

Reference : https://github.com/OpenZeppelin/openzeppelin-contracts/blob/release-v4.1/contracts/token/ERC20/utils/SafeERC20.sol#L74

[r2moon]

If approve failed, then further tx will fail.

[ghoul-sol]

per sponsor comment, best practice