Return values of approve() not checked

[c4-bot-4]

Lines of code

https://github.com/code-423n4/2024-04-panoptic/blob/833312ebd600665b577fbd9c03ffa0daf250ed24/contracts/libraries/InteractionHelper.sol#L32-L37

Vulnerability details

Impact

By not checking the return value, operations that should have marked as failed, may potentially go through without actually approving anything.

Proof of Concept

Not all IERC20 implementations revert() when there's a failure in approve(). The function signature has a boolean return value and they indicate errors that way instead.

There are 4 instance of this issue:

File: libraries/InteractionHelper.sol

32:         IERC20Partial(token0).approve(address(sfpm), type(uint256).max);

33:         IERC20Partial(token1).approve(address(sfpm), type(uint256).max);

36:         IERC20Partial(token0).approve(address(ct0), type(uint256).max);

37:         IERC20Partial(token1).approve(address(ct1), type(uint256).max);

32, 33, 36, 37.

Tools Used

Bot

Recommended Mitigation Steps

Make sure the return value is true.

Assessed type

ERC20

[Picodes]

The worst scenario is that the deployment won't work

[c4-judge]

Picodes changed the severity to QA (Quality Assurance)