New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

QA Report #192

Open

code423n4 opened this issue May 23, 2022 · 0 comments

Labels

bug duplicate QA (Quality Assurance)

Contributor

code423n4 commented May 23, 2022

[L-01] safeApprove is deprecated

The _setupRole function is deprecated according to the Open Zeppelin comment
Deprecated. This function has issues similar to the ones found in {IERC20-approve}, and its usage is discouraged.

There are many safeApprove instances in code
https://github.com/code-423n4/2022-05-aura/blob/main/contracts/AuraLocker.sol#L240
https://github.com/code-423n4/2022-05-aura/blob/main/contracts/AuraLocker.sol#L241
https://github.com/code-423n4/2022-05-aura/blob/main/contracts/AuraMerkleDrop.sol#L131
https://github.com/code-423n4/2022-05-aura/blob/main/contracts/AuraMerkleDrop.sol#L132
https://github.com/code-423n4/2022-05-aura/blob/main/contracts/AuraStakingProxy.sol#L147
https://github.com/code-423n4/2022-05-aura/blob/main/contracts/AuraStakingProxy.sol#L148
https://github.com/code-423n4/2022-05-aura/blob/main/contracts/AuraStakingProxy.sol#L150
https://github.com/code-423n4/2022-05-aura/blob/main/contracts/AuraStakingProxy.sol#L151
https://github.com/code-423n4/2022-05-aura/blob/main/contracts/AuraStakingProxy.sol#L215
https://github.com/code-423n4/2022-05-aura/blob/main/contracts/AuraStakingProxy.sol#L216
https://github.com/code-423n4/2022-05-aura/blob/main/contracts/AuraPenaltyForwarder.sol#L41
https://github.com/code-423n4/2022-05-aura/blob/main/contracts/CrvDepositorWrapper.sol#L52
https://github.com/code-423n4/2022-05-aura/blob/main/contracts/CrvDepositorWrapper.sol#L53
https://github.com/code-423n4/2022-05-aura/blob/main/contracts/AuraClaimZap.sol#L98
https://github.com/code-423n4/2022-05-aura/blob/main/contracts/AuraClaimZap.sol#L99
https://github.com/code-423n4/2022-05-aura/blob/main/contracts/AuraClaimZap.sol#L101
https://github.com/code-423n4/2022-05-aura/blob/main/contracts/AuraClaimZap.sol#L102
https://github.com/code-423n4/2022-05-aura/blob/main/contracts/AuraClaimZap.sol#L104
https://github.com/code-423n4/2022-05-aura/blob/main/contracts/AuraClaimZap.sol#L105
https://github.com/code-423n4/2022-05-aura/blob/main/contracts/BalLiquidityProvider.sol#L59
https://github.com/code-423n4/2022-05-aura/blob/main/contracts/BalLiquidityProvider.sol#L60
https://github.com/code-423n4/2022-05-aura/blob/main/contracts/AuraVestedEscrow.sol#L186
https://github.com/code-423n4/2022-05-aura/blob/main/contracts/AuraBalRewardPool.sol#L75

This Open Zeppelin comment indicates it is deprecated
https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/token/ERC20/utils/SafeERC20.sol#L39-L43

Recommended Mitigation Steps

Replace safeApprove with {safeIncreaseAllowance} or {safeDecreaseAllowance} instead

The text was updated successfully, but these errors were encountered:

code423n4 added bug QA (Quality Assurance) labels

code423n4 added a commit that referenced this issue


          0xkatana issue #192

28480b6

0xMaharishi added the duplicate label

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment