# transferFrom in ERC20Extended will always emit an Approval event if the allowance changes Low/Info · Three Sigma · Stablecoin framework · 8th January, 2024 Finding 3S-M^0-N15 of the M^0 Minter Gateway security review. - Protocol: https://www.m0.org/ - Report: /reports/m-0 - Codebase: https://github.com/0xsimao/ttg/tree/a8127901fa1f24a2e821cf4d9854a1aa6ac8088c - Source: https://cdn.sanity.io/files/qoqld077/production/1cdafafad874aba76e062ad8c216c98338c096db.pdf --- ### Description The [ERC20Extended.transferFrom](https://github.com/MZero-Labs/common/blob/4a37119f2da946c6d8ad7b9a70dfdd219225115b/src/ERC20Extended.sol#L82-L92) function is using _approvefor changing allowance, and this internal function always fires up an Approval event. ### Recommendation The token should not be firing this event unless by calling the external ERC20.approve function. Other common implementations (OpenZeppelin, solmate) also don't fire this event when allowance changes due to a transferFrom call. ### Status Addressed in [#3076d87](https://github.com/MZero-Labs/common/commit/3076d87e1df18eacd5a0c41ccc90367db50ea6f2). --- Related findings: - [State changes should always emit events](https://0xsimao.com/findings/nftperp-i-state-changes-emit-events): Nftperp Exchange - [safeApprove(...) reverts if approval is different than 0, use safeIncreaseAllowance(...) instead](https://0xsimao.com/findings/fuji-finance-approve-reverts-approval-allowance): Fuji Finance - [A user with a TapiocaOFT allowance >0 could steal all the underlying ERC20 tokens of the owner](https://0xsimao.com/findings/tapioca-dao-allowance-steal-underlying-erc20): Tapioca DAO - [Unused `TransferFailed` error in `CodeupERC20`](https://0xsimao.com/findings/codeup-transfer-failed-codeup-erc20): CODEUP