0x52 - Escrow approvals are not cleared when club is transferred allowing for abuse after transfer

[sherlock-admin]

0x52

high

Escrow approvals are not cleared when club is transferred allowing for abuse after transfer

Summary

Escrow approvals remain even across club token transfers. This allows a malicious club owners to sell their club then drain everything after sale due to previous approvals.

Vulnerability Detail

ERC20 and ERC721 token approval persist regardless of the owner of the club. The result is that approvals set by one owner can be accessed after a token has been sold or transferred. This allows the following attack:

1. User A owns clubId = 1
2. User A sets approval to themselves
3. User A sells clubId = 1 to User B
4. User A uses persistent approval to drain all players and tokens

Impact

Malicious approvals can be used to drain club after sale

Code Snippet

FootiumEscrow.sol#L75-L81

FootiumEscrow.sol#L90-L96

Tool used

Manual Review

Recommendation

Club escrow system needs to be redesigned

[logiclogue]

This could be fixed by dropping the escrow as discussed in the other issue. But this will re-surface soon