Skip to content
Request an audit

‹ All findings

SyrupRouter::depositWithPermit() may be DoSed by frontrunning ERC20::permit()

Low/InfoMaple Syrup Router·by the Three Sigma team·Permissionless lending·21st May 20243S-Sy-L02

Report PageSource

Description

SyrupRouter::depositWithPermit() uses the permit functionality of the asset by calling IERC20Like(asset).permit(owner_, address(this), amount_, deadline_, v_, r_, s_);.

Some griefer may spot the SyrupRouter::depositWithPermit() transaction, frontrun it and call the IERC20Like::permit() function directly, spending the nonce of the signature and DoSing the router.

Recommendation

An attacker has no profit from executing so it is not expected to happen, but some measures could still be taken.

Some examples are:

  1. Get the allowance and only call IERC20Like::permit() if it is smaller than amount_.
  2. Use try/catch.
  3. Flashbots.

Status

Addressed in #cb70312

Found during Three Sigma’s team review · 0xSimao on the review team