Description
Withdraw and borrow actions in the BaseRouter require the owner to increase the approval allowances. If the allowance increase and withdrawal action transaction are not done atomically (via a multicall, for example), anyone can withdraw 1 token, which will make the real withdraw action revert due to insufficient balance (borrowing is similar).
Recommendation
Similarly to the deposit(...) action _safePullTokenFrom(...), only the owner of the withdrawal and borrow actions should be able to call these actions directly. To allow someone withdrawing for a user or cross chain withdrawals, the withdrawal should only be allowed if there was a permit action before (same for borrowing).
Status
Acknowledged with the following statement: The issue identified is acknowledged by the Fuji team including the severity and potential for griefing attacks possible with user's excess allowance on the router.
The team intends to implement the discussed solution: combining IRouter.Action.PermitBorrow and IRouter.Action.PermitWithdraw followed respectively by borrow or withdraw operations. Then restrict the "pure" IRouter.Action.Withdraw, and IRouter.Action.Borrow to ONLY be callable when msg.sender is the owner.
This change will be implemented among other pending changes in Q3 2023.