aragon / minime Goto Github PK

The current MiniMe token contract is very underoptimized for SLOADs, especially now that SLOADs are 800 gas and not 50 gas.

We should update the implementation to make the contract more performant.

According to the analysis from ForceDAO

Hackers can get the tokens from transferFrom, which returns false instead of revert. This part of the contract is forked from this repository.

ForceDAO contract: 0x6807d7f7df53b7739f6438eabd40ab8c262c0aa8

The documentation implies the current block, but the implementation at l359 uses block - 1.

Not sure how we missed that one 😅.

See https://github.com/aragon/minime/blob/master/contracts/MiniMeToken.sol#L232-L236.

Some discussion on this was held in OpenZeppelin: github.com/OpenZeppelin/openzeppelin-contracts/issues/438, and is in the ERC20 spec:

NOTE: To prevent attack vectors like the one described here and discussed here, clients SHOULD make sure to create user interfaces in such a way that they set the allowance first to 0 before setting it to another value for the same spender. THOUGH The contract itself shouldn't enforce it, to allow backwards compatilibilty with contracts deployed before