ERC20Votes tokens has maximum token supply capped at type(uint208).max approving type(uint256).max in ERC20ProxyDelegator will cause overflow

Lines of code Vulnerability details Impact Maximum token supply in OpenZeppelin ERC20Votes.sol. Defaults to typeuint208.max 2^208^ - 1. This maximum is enforced in update. It limits the total supply of the token, which is otherwise a uint256, so that checkpoints can be stored in the Trace208...

ERC20ProxyDelegator contract will always lead to zero approval

Lines of code Vulnerability details Impact In constructor of ERC20ProxyDelegator contract token.approve have typeuint256.max. This leads to approval remain zero as nothing will happens due to wrong value provided. The main reason is due to the max approval attainable is typeuint256.max – 1. This...

Unrestricted delegator contract deployment risks gas abuse; implement mitigations.

Lines of code Vulnerability details Impact deployProxyDelegatorIfNeeded deploys a new delegator contract if one does not exist. This could be abused to spam deploy many delegators and waste gas. Proof of Concept The issue with potentially spam deploying many delegator contracts occurs in the...

Needs a secure modifier

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. The ERC20ProxyDelegator constructor appears to be used for delegating voting rights to a delegate by allowing them to call the delegate function of an ERC20Votes contract. To secure this function, you...

Some ERC20Votes tokens will not work if you set approve() to any value without setting to zero first

Lines of code Vulnerability details Impact Not setting allowance to Zero before changing the allowance can hinder the deployment of the ERC20ProxyDelegator contract for some ERC20 tokens Proof of Concept Some ERC20 tokens like USDT with Voting enabled will not work when changing the allowance fro...

can not transfer voting tokens between ERC20ProxyDelegator contracts even if he supplied funds before

Lines of code Vulnerability details Description if a user wants to delegate voting power to a delegate he will call the function delegateMulti with targets array set to the address of the delegates he wants to delegate to, but the targets array is uint and not address type, so the user needs to...

User is unable to undelegate their votes from a ProxyDelegator

Lines of code Vulnerability details Impact The delegate is used to delegate sender's votes to someone else without the need to actually send the tokens. Here is a quick intro for the function: delegateaddress delegatee This function allows msg.sender to delegate their voting power to delegatee an...

Possibility of security vulnerabilities introduced by creating ERC20ProxyDelegator instances on the fly using static salt values

Lines of code Vulnerability details Impact Security risks associated with deploying proxy contracts via deterministic addresses that can be easily calculated. In deployProxyDelegatorIfNeeded, in the case that extcodesizeproxyAddress == 0, then a proxy contract is instantiated ad hoc via new...

Possible hash collision in retrieveProxyContractAddress()

Lines of code Vulnerability details Impact implemention of keccak256abi.encodePackeda, b with both dynamic types or same type with dynamic nature leads to collision in hash. Proof of Concept From the sol docs:link. i.e If you use keccak256abi.encodePackeda, b and both a and b are dynamic types, i...

Zero address Salt used in Creating delegate contract

Lines of code Vulnerability details Impact A zero-valued salt used, means an attacker can predict the contract address of a new delegate, this can lead an attacker to create the ERC20ProxyDelegator on behalf of the user, this is to allow for max access to the tokens to be transfered Proof of...