Skip to content
Request an audit

‹ Findings database

transferFrom in ERC20Extended will always emit an Approval event if the allowance changes

Low/InfoM^0 Minter Gateway audit·Three Sigma·Stablecoin framework·8th January, 20243S-M^0-N15

Description

The ERC20Extended.transferFrom function is using _approvefor changing allowance, and this internal function always fires up an Approval event.

Recommendation

The token should not be firing this event unless by calling the external ERC20.approve function. Other common implementations (OpenZeppelin, solmate) also don't fire this event when allowance changes due to a transferFrom call.

Status

Addressed in #3076d87.

Source

Disclosed by 0xSimao · Sherlock's 2025 Watson of the Year · 21 first places in 57 audit contests