Comments (2)
Thanks @PatrickAlphaC. This is correct, but forceApprove
may be better our case, wdyt?
In the only usage of safeApprove
, the intention is to approve
to 0, before actual approve to support USDT
like tokens. This can be achieved by using forceApprove
instead.
from era-contracts.
You introduce a race condition if you always use forceApprove.
Here is the scenario:
- Bob
forceApprove
Sally to spend 10 tokens. - Bob decides he actually wants her to be able to spend 15 instead of 10, so sends another
forceApprove
transaction for 15 tokens. - Before Bob's transaction lands, Sally notices this, and front-runs the transaction, spends the 10 tokens. Now Bob's
forceApprove
transaction hits for an additional 15. - Sally is able to spend 25 tokens instead of the 15 she was supposed to spend.
If instead, Bob used safeIncreaseAllowance
, he would have increased the allowance by 5, so Sally only would have ever been able to spend the 15 tokens Bob originally intended.
Additionally, the new openzeppelin contracts use forceApprove
inside of the safeIncreaseAllowance
function anyways.
from era-contracts.
Related Issues (14)
- L2StandardERC20 not being initialized correctly HOT 4
- proveL2MessageInclusion reverted "xx" code HOT 1
- [Proposal] Custom base token support HOT 9
- Regarding fees HOT 8
- Script Bug Report for SystemContractsCaller.sol HOT 1
- TransactionHelper -> `generateBasicTransaction`
- Add running tests to the `README`
- Introduce memory based `TransactionHelper` HOT 3
- Use structs to remove being forced to compile via ir HOT 3
- Since this repo is intended to be a package, you need a floating point pragma
- Include audits
- Update natspec for `IContractDeployer`
- Interaface abstraction
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from era-contracts.