# Approval in BaseVault reduces over time Medium · Three Sigma · Lending aggregator · 6th May, 2023 Finding 3S-FUJI-M03 of the Fuji Finance security review. - Report: /reports/fuji-finance - Source: https://cdn.sanity.io/files/qoqld077/staging/32181a28eac3175d15fb8924d249bb0d91ca350c.pdf --- ### Description BaseVault stores users allowances as underlying assets allowances. When a user calls, for example, approve(...), it converts the shares amount in the argument to a corresponding asset amount. This approach means that, over time, due to the value of shares increasing over time (yield from providers), the same amount of shares will be worth more assets. Thus, if users approve a certain allowance, and then a few seconds later, another user tries to use this same allowance amount, it should revert, as this shares amount now equals more assets. The BorrowingVault does not have this issue because it never converts between debt and debtShares and the allowance is stored in debt. Thus, if a user approves another user for, let's say, 100 debt, the other user can always spend 100 debt. ### Recommendation Instead of converting to the underlying assets, store the allowances in shares. This is how the [openzeppelin ERC4626](https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/token/ERC20/extensions/ERC4626.sol#L50) implementation does it and is more reliable. ### POC https://github.com/threesigmaxyz/fuji-issues-external/blob/master/test/POC/POCFaillingApproval.t.sol#L32 ### Status Acknowledged with the following statement: The issue identified is acknowledged by the Fuji team, however, the team encountered that such change will require major refactors at: smart contracts, sdk, and front-end. Therefore, they intend to address this issue in Q4-2023, to replace storing assets for asset-shares allowance. --- Related findings: - [`BaseTOFT.sol`: `retrieveFromStrategy` can be used to manipulate other user's positions due to absent approval check](https://0xsimao.com/findings/tapioca-dao-retrieve-manipulate-absent-approval): Tapioca DAO - [KeyringCoreV2Base::_createCredential() could use currentTime instead of block.timestamp on the creatBefore check](https://0xsimao.com/findings/keyring-ii-credential-current-timestamp-creat): Keyring Credentials