Skinny Shadow Sparrow - Lack of Approval for Token Transfer between Surrogates

[sherlock-admin4]

Skinny Shadow Sparrow

Medium

Lack of Approval for Token Transfer between Surrogates

Summary

When alterDelegatee is called it changes the delegates but also calls _fetchOrDeploySurrogate which deploys a new contract surrogate. Then we proceed with a safeTransfer from the old one to the new one. This will always fail since the old one didnt approved the new one. Broken Logic

Impact

Broken Logic. alterDelegate will always fail and revert since token transfer from old one to the new one wont be able to transfer

Code Snippet

https://github.com/sherlock-audit/2024-11-tally/blob/main/staker/src/GovernanceStaker.sol#L374-L378
https://github.com/sherlock-audit/2024-11-tally/blob/main/staker/src/GovernanceStaker.sol#L624-L648

Tool used

Manual Review

Recommendation

add Approve