R-Nemes - Unsafe use approve ERC20

[sherlock-admin]

R-Nemes

medium

Unsafe use approve ERC20

[M01] Use of unsafe approve ERC20

Summary

It is recommended to reduce the spender allowance to zero before each approve(, ) call.

Vulnerability Detail

IERC20.approve() function is called without setting the allowance to zero. Some tokens, like USDT, require first reducing the address' allowance to zero by calling approve(_spender, 0).

Impact

Some tokens, like USDT, require first reducing the address' allowance to zero by calling approve(_spender, 0). Transactions will revert when using an unsupported token like USDT

Code Snippet

https://github.com/sherlock-audit/2023-04-footium/blob/main/footium-eth-shareable/contracts/FootiumEscrow.sol#L75-L81

    function setApprovalForERC20(
        IERC20 erc20Contract,
        address to,
        uint256 amount
    ) external onlyClubOwner {
        erc20Contract.approve(to, amount);
    }

Tool used

Manual review

Recommendation

    function setApprovalForERC20(
        IERC20 erc20Contract,
        address to,
        uint256 amount
    ) external onlyClubOwner {
		erc20Contract.approve(to, 0);
        erc20Contract.approve(to, amount);
    }

Duplicate of #86