Avoid the use of increaseAllowance and decreaseAllowance from ERC20 that are recently deprecated

[c4-submissions]

Lines of code

https://github.com/code-423n4/2023-10-badger/blob/main/packages/contracts/contracts/EBTCToken.sol?plain=1#L152-L170

Vulnerability details

Impact

Recently, the increaseAllowance function has been removed from the OpenZeppelin ERC20 contract due to its exploitation in phishing attacks and to prevent the possibility of further phishing attacks.

See (OpenZeppelin/openzeppelin-contracts#4583](OpenZeppelin/openzeppelin-contracts#4583) . We should remove the functions increaseAllowance and decreaseAllowance as they only solve an imaginary problem.

These functions are not part of the EIP-20 specs.

Using these functions will result in unexpected behaviour which will cause contracts to become corrupted.

These functions may allow for further phishing possibilities.

Proof of Concept

https://github.com/code-423n4/2023-10-badger/blob/main/packages/contracts/contracts/EBTCToken.sol?plain=1#L152-L170

    function increaseAllowance(
        address spender,
        uint256 addedValue
    ) external override returns (bool) {
        _approve(msg.sender, spender, _allowances[msg.sender][spender] + addedValue);
        return true;
    }

    function decreaseAllowance(
        address spender,
        uint256 subtractedValue
    ) external override returns (bool) {
        uint256 cachedAllowances = _allowances[msg.sender][spender];
        require(cachedAllowances >= subtractedValue, "ERC20: decreased allowance below zero");
        unchecked {
            _approve(msg.sender, spender, cachedAllowances - subtractedValue);
        }
        return true;
    }

Tools Used

Manual code review

Recommended Mitigation Steps

considering removing increaseAllowance/decreaseAllowance function from EBTCToken contract.

Or implement a function similar to this SafeERC20 library which is still available.

Assessed type

ERC20

[bytes032]

• Not a vulnerability
• Over inflated severity

[c4-pre-sort]

bytes032 marked the issue as insufficient quality report

[c4-sponsor]

GalloDaSballo (sponsor) disputed

[GalloDaSballo]

We could call it dog.bark and it would still just be an opinion

[c4-judge]

jhsagd76 marked the issue as unsatisfactory:
Invalid