Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Consider Handling of Updating Expired Allowances in CW20 Contract #909

Open
yuxuan-xie opened this issue Jul 2, 2024 · 0 comments
Open

Comments

@yuxuan-xie
Copy link

yuxuan-xie commented Jul 2, 2024

Hi Team,

I've encountered an issue when working with the IncreaseAllowance and DecreaseAllowance message and updating expired allowances.

Currently, if I assign an allowance to a spender with an expiration(i.e, valid for 10 blocks), and the spender does not use up this allowance by the time it expires, the expired amount of tokens is still considered when I increase the allowance for the same spender later on. The same is true for decreasing the allowance of the spender with a valid expiration. This results in the spender having a higher amount of valid tokens than intended.

Illustrative example:

  1. Owner A assigns an allowance of 100 tokens to Spender B, valid for 10 blocks.
  2. Spender B does not use the allowance, and it expires.
  3. Owner A then need to assign an additional allowance of 100 tokens to Spender B
  4. Therefore, Owner A uses IncreaseAllowance message and assigns the second allowance of 100 tokens.
  5. However, Spender B now has access to 200 tokens, not 100. The expired allowance has been effectively revived.

I understand that owner can query the actual allowance before increasing or decreasing it to decide the proper amount. However, from my opinion, it would be more logical and intuitive for the expired allowance to be discarded.

One possible solution might be having default allowance if the allowance is expired.

I would love to hear your thoughts on this. Would you consider this as a viable improvement for the CW20 contract?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant