Proud Taffy Kestrel - ABONDToken::transferFrom() updates spender user state instead of sender's one

[sherlock-admin4]

Proud Taffy Kestrel

Medium

ABONDToken::transferFrom() updates spender user state instead of sender's one

Summary

The ABONDToken::transferFrom() function debits sender's balance, but changed user state assigns to the spender, instead of sender.

Root Cause

In ABONDToken::transferFrom() debited user state assigns to the msg.sender, so ABONDToken.userStates becomes out of sync with users token balances.

Internal pre-conditions

1. User allowed to spend some amount of ABONDToken to the spender

External pre-conditions

No response

Attack Path

1. User allowed to spend some amount of ABONDToken to the spender
2. Spender calls ABONDToken.transferFrom() with user's address as from param
3. Spender receives user's State in the userStates mapping

Impact

ABONDToken.userStates becomes out of sync with users ABONDToken balances

PoC

No response

Mitigation

No response