Description
BaseVault stores users allowances as underlying assets allowances. When a user calls, for example, approve(...), it converts the shares amount in the argument to a corresponding asset amount. This approach means that, over time, due to the value of shares increasing over time (yield from providers), the same amount of shares will be worth more assets.
Thus, if users approve a certain allowance, and then a few seconds later, another user tries to use this same allowance amount, it should revert, as this shares amount now equals more assets. The BorrowingVault does not have this issue because it never converts between debt and debtShares and the allowance is stored in debt.
Thus, if a user approves another user for, let's say, 100 debt, the other user can always spend 100 debt.
Recommendation
Instead of converting to the underlying assets, store the allowances in shares. This is how the openzeppelin ERC4626 implementation does it and is more reliable.
POC
Status
Acknowledged with the following statement: The issue identified is acknowledged by the Fuji team, however, the team encountered that such change will require major refactors at: smart contracts, sdk, and front-end.
Therefore, they intend to address this issue in Q4-2023, to replace storing assets for asset-shares allowance.