shaflow01 - The contract should immediately revoke the authorization, rather than waiting for the next interaction.

[sherlock-admin2]

shaflow01

Medium

The contract should immediately revoke the authorization, rather than waiting for the next interaction.

Summary

The contract should immediately revoke the authorization, rather than waiting for the next interaction.

Root Cause

https://github.com/sherlock-audit/2024-11-telcoin/blob/main/telcoin-audit/contracts/swap/AmirX.sol#L195

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

1. The allowance is not immediately cleared after calling the aggregator swap.

2. Malicious users can abuse the allowance by using part of the aggregator functions.

Impact

A malicious user could manipulate the aggregator to exploit the allowance.

PoC

No response

Mitigation

The contract should immediately revoke all allowances after the swap is completed.