# SyrupRouter::depositWithPermit() may be DoSed by frontrunning ERC20::permit() Low/Info · Three Sigma · Permissionless lending · 21st May 2024 Finding 3S-Sy-L02 of the Maple Syrup Router security review. - Protocol: https://maple.finance/ - Report: /reports/maple-syrup-router - Source: https://github.com/0xsimao/audits/blob/main/Three%20Sigma/2024-05-21-maple-finance-syrup-router.pdf --- ### Description [SyrupRouter::depositWithPermit()](https://github.com/maple-labs/syrup-router/blob/main/contracts/SyrupRouter.sol#L39) uses the permit functionality of the asset by [calling](https://github.com/maple-labs/syrup-router/blob/main/contracts/SyrupRouter.sol#L47) IERC20Like(asset).permit(owner_, address([this](https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/utils/cryptography/EIP712.sol#L88-L90)), amount_, deadline_, v_, r_, s_);. Some griefer may spot the SyrupRouter::depositWithPermit() transaction, frontrun it and call the IERC20Like::permit() function directly, spending the nonce of the signature and DoSing the router. ### Recommendation An attacker has no profit from executing so it [is](https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/utils/cryptography/EIP712.sol#L37-L38) not expected to happen, but some measures could still be taken. Some [examples](https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/token/ERC20/extensions/ERC20Permit.sol) are: 1. Get the allowance and only call IERC20Like::permit() if it [is](https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/utils/cryptography/MessageHashUtils.sol#L76) smaller than amount_. 2. Use try/catch. 3. Flashbots. ### Status Addressed in [#cb70312](https://github.com/maple-labs/syrup-utils/commit/cb70312a1e92dfe2232384e3b642ebebf1914e02) Disclosed by 0xSimao (https://0xsimao.com/). --- Related findings: - [Batch:withdraw() can be DoSed by frontrunning it with strategyRouter:allocateToStrategies()](https://0xsimao.com/findings/clip-finance-i-withdraw-frontrunning-allocate-strategies): Clip Finance Strategies - [`SyrupBitcoinRouter::processRedemptions()` could be optimized by batching transfers together](https://0xsimao.com/findings/maple-finance-iii-process-batching-transfers-together): Maple Withdrawal Queue - [`SyrupBitcoinRouter::setAssetController()` could always allow the asset controller to be set to 0](https://0xsimao.com/findings/maple-finance-iii-syrup-bitcoin-asset-controller): Maple Withdrawal Queue - [`SyrupBitcoinRouter::requestRedeem()` could also check if the asset picked to redeem has liquidity](https://0xsimao.com/findings/maple-finance-iii-syrup-bitcoin-redeem-picked): Maple Withdrawal Queue