Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

docs: [L-06] revokeOperator() does not protect against the double-spending allowance attack #834

Merged
merged 4 commits into from
Jan 9, 2024
Merged
Show file tree
Hide file tree
Changes from 2 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 2 additions & 7 deletions contracts/LSP7DigitalAsset/LSP7DigitalAssetCore.sol
Original file line number Diff line number Diff line change
Expand Up @@ -48,9 +48,6 @@ import {
* @dev Core Implementation of a LSP7 compliant contract.
*
* This contract implement the core logic of the functions for the {ILSP7DigitalAsset} interface.
*
* Similar to ERC20, the non-standard {increaseAllowance} and {decreaseAllowance} functions
* have been added to mitigate the well-known issues around setting allowances.
*/
abstract contract LSP7DigitalAssetCore is ILSP7DigitalAsset {
using EnumerableSet for EnumerableSet.AddressSet;
Expand Down Expand Up @@ -143,10 +140,8 @@ abstract contract LSP7DigitalAssetCore is ILSP7DigitalAsset {
* @inheritdoc ILSP7DigitalAsset
*
* @custom:danger To avoid front-running and Allowance Double-Spend Exploit when
* increasing or decreasing the authorized amount of an operator, it is advised to:
*
* 1. either call {revokeOperator} first, and then re-call {authorizeOperator} with the new amount.
* 2. or use the non-standard functions {increaseAllowance} or {decreaseAllowance}.
* increasing or decreasing the authorized amount of an operator, it is advised to
* use the {increaseAllowance} or {decreaseAllowance} function.
*
* For more information, see:
* https://docs.google.com/document/d/1YLPtQxZu1UAvO9cZ1O2RPXBbT0mooh4DYKjA_jp-RLM/
Expand Down
2 changes: 1 addition & 1 deletion docs/contracts/LSP7DigitalAsset/LSP7DigitalAsset.md
Original file line number Diff line number Diff line change
Expand Up @@ -90,7 +90,7 @@ Reverts whenever someone tries to send native tokens to a LSP7 contract.

:::danger

To avoid front-running and Allowance Double-Spend Exploit when increasing or decreasing the authorized amount of an operator, it is advised to: 1. either call [`revokeOperator`](#revokeoperator) first, and then re-call [`authorizeOperator`](#authorizeoperator) with the new amount. 2. or use the non-standard functions [`increaseAllowance`](#increaseallowance) or [`decreaseAllowance`](#decreaseallowance). For more information, see: https://docs.google.com/document/d/1YLPtQxZu1UAvO9cZ1O2RPXBbT0mooh4DYKjA_jp-RLM/
To avoid front-running and Allowance Double-Spend Exploit when increasing or decreasing the authorized amount of an operator, it is advised to use the [`increaseAllowance`](#increaseallowance) or [`decreaseAllowance`](#decreaseallowance) function. For more information, see: https://docs.google.com/document/d/1YLPtQxZu1UAvO9cZ1O2RPXBbT0mooh4DYKjA_jp-RLM/

:::

Expand Down
2 changes: 1 addition & 1 deletion docs/contracts/LSP7DigitalAsset/extensions/LSP7Burnable.md
Original file line number Diff line number Diff line change
Expand Up @@ -88,7 +88,7 @@ Reverts whenever someone tries to send native tokens to a LSP7 contract.

:::danger

To avoid front-running and Allowance Double-Spend Exploit when increasing or decreasing the authorized amount of an operator, it is advised to: 1. either call [`revokeOperator`](#revokeoperator) first, and then re-call [`authorizeOperator`](#authorizeoperator) with the new amount. 2. or use the non-standard functions [`increaseAllowance`](#increaseallowance) or [`decreaseAllowance`](#decreaseallowance). For more information, see: https://docs.google.com/document/d/1YLPtQxZu1UAvO9cZ1O2RPXBbT0mooh4DYKjA_jp-RLM/
To avoid front-running and Allowance Double-Spend Exploit when increasing or decreasing the authorized amount of an operator, it is advised to use the [`increaseAllowance`](#increaseallowance) or [`decreaseAllowance`](#decreaseallowance) function. For more information, see: https://docs.google.com/document/d/1YLPtQxZu1UAvO9cZ1O2RPXBbT0mooh4DYKjA_jp-RLM/

:::

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -88,7 +88,7 @@ Reverts whenever someone tries to send native tokens to a LSP7 contract.

:::danger

To avoid front-running and Allowance Double-Spend Exploit when increasing or decreasing the authorized amount of an operator, it is advised to: 1. either call [`revokeOperator`](#revokeoperator) first, and then re-call [`authorizeOperator`](#authorizeoperator) with the new amount. 2. or use the non-standard functions [`increaseAllowance`](#increaseallowance) or [`decreaseAllowance`](#decreaseallowance). For more information, see: https://docs.google.com/document/d/1YLPtQxZu1UAvO9cZ1O2RPXBbT0mooh4DYKjA_jp-RLM/
To avoid front-running and Allowance Double-Spend Exploit when increasing or decreasing the authorized amount of an operator, it is advised to use the [`increaseAllowance`](#increaseallowance) or [`decreaseAllowance`](#decreaseallowance) function. For more information, see: https://docs.google.com/document/d/1YLPtQxZu1UAvO9cZ1O2RPXBbT0mooh4DYKjA_jp-RLM/

:::

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -158,7 +158,7 @@ Approval function from th ERC20 standard interface.

:::danger

To avoid front-running and Allowance Double-Spend Exploit when increasing or decreasing the authorized amount of an operator, it is advised to: 1. either call [`revokeOperator`](#revokeoperator) first, and then re-call [`authorizeOperator`](#authorizeoperator) with the new amount. 2. or use the non-standard functions [`increaseAllowance`](#increaseallowance) or [`decreaseAllowance`](#decreaseallowance). For more information, see: https://docs.google.com/document/d/1YLPtQxZu1UAvO9cZ1O2RPXBbT0mooh4DYKjA_jp-RLM/
To avoid front-running and Allowance Double-Spend Exploit when increasing or decreasing the authorized amount of an operator, it is advised to use the [`increaseAllowance`](#increaseallowance) or [`decreaseAllowance`](#decreaseallowance) function. For more information, see: https://docs.google.com/document/d/1YLPtQxZu1UAvO9cZ1O2RPXBbT0mooh4DYKjA_jp-RLM/

:::

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -165,7 +165,7 @@ Approval function from th ERC20 standard interface.

:::danger

To avoid front-running and Allowance Double-Spend Exploit when increasing or decreasing the authorized amount of an operator, it is advised to: 1. either call [`revokeOperator`](#revokeoperator) first, and then re-call [`authorizeOperator`](#authorizeoperator) with the new amount. 2. or use the non-standard functions [`increaseAllowance`](#increaseallowance) or [`decreaseAllowance`](#decreaseallowance). For more information, see: https://docs.google.com/document/d/1YLPtQxZu1UAvO9cZ1O2RPXBbT0mooh4DYKjA_jp-RLM/
To avoid front-running and Allowance Double-Spend Exploit when increasing or decreasing the authorized amount of an operator, it is advised to use the [`increaseAllowance`](#increaseallowance) or [`decreaseAllowance`](#decreaseallowance) function. For more information, see: https://docs.google.com/document/d/1YLPtQxZu1UAvO9cZ1O2RPXBbT0mooh4DYKjA_jp-RLM/

:::

Expand Down
2 changes: 1 addition & 1 deletion docs/contracts/LSP7DigitalAsset/presets/LSP7Mintable.md
Original file line number Diff line number Diff line change
Expand Up @@ -121,7 +121,7 @@ Reverts whenever someone tries to send native tokens to a LSP7 contract.

:::danger

To avoid front-running and Allowance Double-Spend Exploit when increasing or decreasing the authorized amount of an operator, it is advised to: 1. either call [`revokeOperator`](#revokeoperator) first, and then re-call [`authorizeOperator`](#authorizeoperator) with the new amount. 2. or use the non-standard functions [`increaseAllowance`](#increaseallowance) or [`decreaseAllowance`](#decreaseallowance). For more information, see: https://docs.google.com/document/d/1YLPtQxZu1UAvO9cZ1O2RPXBbT0mooh4DYKjA_jp-RLM/
To avoid front-running and Allowance Double-Spend Exploit when increasing or decreasing the authorized amount of an operator, it is advised to use the [`increaseAllowance`](#increaseallowance) or [`decreaseAllowance`](#decreaseallowance) function. For more information, see: https://docs.google.com/document/d/1YLPtQxZu1UAvO9cZ1O2RPXBbT0mooh4DYKjA_jp-RLM/

:::

Expand Down