T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/mintSYT.js:43
- Finding
- Unlimited USDC Approval Exposes Current and Future Wallet Funds<![CDATA[ ## Vulnerability Details **File Location**: `scripts/mintSYT.js:43-50` **Vulnerability Type**: Excessive ERC-20 token allowance **Risk Level**: High ### Vulnerable Code ```javascript // 2. Approve if necessary if (currentAllowance < amountInWei) { console.log("Allowance insufficient. Sending approval transaction..."); const approveHash = await walletClient.writeContract({ address: USDC_LINEA, abi: erc20Abi, functionName: 'approve', args: [LOCKER_ROUTER, maxUint256] // Infinite approval to save gas on future mints }); ``` ### Technical Analysis When the existing allowance is insufficient, the script grants the hard-coded Locker Router the maximum possible ERC-20 allowance rather than limiting approval to the requested deposit amount. ERC-20 allowances persist until they are consumed or explicitly revoked. Consequently, the router remains authorized to transfer any USDC subsequently held by the wallet. The authorization is substantially broader in amount and duration than necessary to complete the requested deposit. This becomes exploitable if the router contract is malicious, compromised, incorrectly upgradeable, or contains a vulnerability that permits unauthorized use of `transferFrom`. The project does disclose the infinite approval in its README, but disclosure does not eliminate the residual authorization risk. ### Attack Path 1. A user runs `node scripts/mintSYT.js <amount>`. 2. The script detects that the existing allowance is below the deposit amount. 3. The wallet signs an approval granting the router an allowance of `maxUint256`. 4. The requested deposit completes, but the unused authorization remains active. 5. The wallet later receives or retains additional USDC. 6. An attacker compromises or exploits the approved router, or otherwise gains the ability to invoke its token-spending capability. 7. The attacker uses the persistent allowance to transfer USDC from the wallet without a new approv ...[truncated 348 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Approve only the amount required for the current deposit: ```javascript args: [LOCKER_ROUTER, amountInWei] ``` 2. If repeated deposits must be optimized, require explicit user consent before granting an unlimited allowance rather than making it the default. 3. Provide a command that revokes the router allowance by approving zero. 4. Display the existing allowance and the exact requested approval before signing. 5. Verify whether the deployed router is upgradeable and document its administrator and security assumptions. 6. Simulate the deposit before submission and verify the transaction receipt status. 7. Where supported, use signature-based, amount-limited approvals such as Permit or Permit2 with a short expiration. ]]>