fix(diem-staking): approve exact stake amount instead of unlimited DIEM allowance#595
Closed
Augustas11 wants to merge 1 commit into
Closed
fix(diem-staking): approve exact stake amount instead of unlimited DIEM allowance#595Augustas11 wants to merge 1 commit into
Augustas11 wants to merge 1 commit into
Conversation
…EM allowance Replaces maxUint256 approval in useApproveDiem with the exact amount the user is about to stake. Users now see an "Approve X DIEM" wallet prompt rather than an unlimited allowance request — safer if the staking proxy is ever upgraded or compromised. One approve per stake operation is the accepted best practice. Fixes BUG-155. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Why
Unlimited ERC-20 allowances are a known blast-radius amplifier. If the staking proxy is ever upgraded with a bug or a key is compromised, a standing maxUint256 approval gives an attacker full access to every user's DIEM balance. Approving exactly the stake amount eliminates that risk. Users will now see "Approve X DIEM" in their wallet instead of "Approve unlimited".
Test plan
Fixes BUG-155.
Generated with Claude Code