Booster Manual Review Findings

BOO-01M: Deprecated Approval Paradigm

Description:

The linked statements utilize the safeApprove function that has been officially deprecated.

Example:

Copy
296//send stakers's share of ptp to reward contract
297SafeERC20.safeApprove(ptp, ecdStakerRewardPool, 0);
298SafeERC20.safeApprove(ptp, ecdStakerRewardPool, amount);

Recommendation:

We advise a direct approve instruction to be utilized instead as the statements are indeed meant to replace any previously set allowance to the new one.

Alleviation:

A direct approve statement is now utilized in all referenced instances in place of the deprecated paradigm.

BOO-02M: Improper Approval Assignment

Description:

The linked code improperly assigns the allowance the ecdStakerRewardPool contract should possess as it assigns an approval equal to amount instead of _ecdLockedIncentive.

Example:

Copy
296//send stakers's share of ptp to reward contract
297SafeERC20.safeApprove(ptp, ecdStakerRewardPool, 0);
298SafeERC20.safeApprove(ptp, ecdStakerRewardPool, amount);
299
300IVeEcdRewardsPool(ecdStakerRewardPool).queueNewRewards(
301    _ecdLockedIncentive
302);

Recommendation:

We advise the code to be revised to utilize the proper approval amount.

Alleviation:

The approvals were refactored to be performed on a need-to basis thereby alleviating this exhibit.