fix: Allowance Double-Spend Exploit [NAY-16]

nayms · Apr 28, 2023 · 269e3e1 · 269e3e1
1 parent bf471e7
commit 269e3e1
Show file tree

Hide file tree

Showing 2 changed files with 34 additions and 0 deletions.
diff --git a/src/erc20/ERC20Wrapper.sol b/src/erc20/ERC20Wrapper.sol
@@ -79,6 +79,23 @@ contract ERC20Wrapper is IERC20, ReentrancyGuard {
         return true;
     }
 
+    function increaseAllowance(address spender, uint256 addedValue) public virtual returns (bool) {
+        require(type(uint256).max - allowances[msg.sender][spender] >= addedValue, "ERC20: allowance overflow");
+        unchecked {
+            allowances[msg.sender][spender] += addedValue;
+        }
+        return true;
+    }
+
+    function decreaseAllowance(address spender, uint256 subtractedValue) public virtual returns (bool) {
+        uint256 currentAllowance = allowances[msg.sender][spender];
+        require(currentAllowance >= subtractedValue, "ERC20: decreased allowance below zero");
+        unchecked {
+            allowances[msg.sender][spender] -= subtractedValue;
+        }
+        return true;
+    }
+
     function transferFrom(
         address from,
         address to,

diff --git a/test/T05TokenWrapper.t.sol b/test/T05TokenWrapper.t.sol
@@ -95,6 +95,23 @@ contract T05TokenWrapper is D03ProtocolDefaults {
         assertEq(wrapper.balanceOf(account0), tokenAmount, "account0 balance should increase");
 
         assertEq(wrapper.allowance(signer1, account0), 0, "allowance should have decreased");
+
+        vm.startPrank(signer1);
+        wrapper.increaseAllowance(account0, type(uint256).max);
+        assertEq(wrapper.allowance(signer1, account0), type(uint256).max, "allowance should have increased");
+
+        vm.expectRevert("ERC20: allowance overflow");
+        wrapper.increaseAllowance(account0, 1);
+        vm.stopPrank();
+
+        vm.startPrank(signer1);
+        wrapper.decreaseAllowance(account0, type(uint256).max);
+        assertEq(wrapper.allowance(signer1, account0), 0, "allowance should have decreased");
+
+        vm.expectRevert("ERC20: decreased allowance below zero");
+        wrapper.decreaseAllowance(account0, 1);
+        vm.stopPrank();
+
     }
 
     function testPermit() public {