Approve 0 first

[code423n4]

Handle

pauliax

Vulnerability details

Impact

Rebalance managers approve max if allowance < quantity. SingleTokenJoin, SingleTokenJoinV2, SingleNativeTokenExit, and SingleNativeTokenExitV2. approve max if allowance < balance.

The problem is that some tokens, e.g. USDT require resetting approval to 0 before approving any value again.

Recommended Mitigation Steps

Consider using this approach:

  token.approve(spender, 0);
  token.approve(spender, uint256(-1));