DoS due to approve in claimGovFees Lock.sol

[code423n4]

Lines of code

https://github.com/code-423n4/2022-12-tigris/blob/588c84b7bb354d20cbca6034544c4faa46e6a80e/contracts/Lock.sol#L117

Vulnerability details

Impact

https://github.com/code-423n4/2022-12-tigris/blob/588c84b7bb354d20cbca6034544c4faa46e6a80e/contracts/Lock.sol#L117

    /**
     * @notice Claim rewards from gov nfts and distribute them to bonds
     */
    function claimGovFees() public {
        address[] memory assets = bondNFT.getAssets();

        for (uint i=0; i < assets.length; i++) {
            uint balanceBefore = IERC20(assets[i]).balanceOf(address(this));
            IGovNFT(govNFT).claim(assets[i]);
            uint balanceAfter = IERC20(assets[i]).balanceOf(address(this));
            IERC20(assets[i]).approve(address(bondNFT), type(uint256).max);
            bondNFT.distribute(assets[i], balanceAfter - balanceBefore);
        }
    }

Some ERC20 require approve set to zero before a approve can be done, like USDT https://etherscan.io/token/0xdac17f958d2ee523a2206206994597c13d831ec7#code

require(!((_value != 0) && (allowed[msg.sender][_spender] != 0)));

So if USDT is added as an bondNFT asset, this approve call we be fail, and the claimGovFees will revert, causing DoS.

Proof of Concept

Code given above

Tools Used

None

Recommended Mitigation Steps

Remove approve and just send asset to bondNFT contract

[c4-judge]

GalloDaSballo marked the issue as duplicate of #198

[c4-judge]

GalloDaSballo marked the issue as satisfactory