[KGA-24][KGA-128] fix: check kakarot approval dualVMToken (#1622)

code-423n4/2024-09-kakarot-findings#48 code-423n4/2024-09-kakarot-findings#116
kkrt-labs · Nov 20, 2024 · 6fbdc16 · 6fbdc16
1 parent bdfa507
commit 6fbdc16
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 1 deletion.
diff --git a/solidity_contracts/src/CairoPrecompiles/DualVmToken.sol b/solidity_contracts/src/CairoPrecompiles/DualVmToken.sol
@@ -233,7 +233,7 @@ contract DualVmToken is NoDelegateCall {
     }
 
     function _approve(uint256 spender, uint256 amount) private {
-        if (spender >= STARKNET_FIELD_PRIME) {
+        if (spender >= STARKNET_FIELD_PRIME || spender == kakarot) {
             revert InvalidStarknetAddress();
         }
         // Split amount in [low, high]

diff --git a/tests/end_to_end/CairoPrecompiles/test_dual_vm_token.py b/tests/end_to_end/CairoPrecompiles/test_dual_vm_token.py
@@ -244,6 +244,13 @@ async def test_should_revert_approve_starknet_address_invalid_address(
             with cairo_error(evm_error):
                 await dual_vm_token.functions["approve(uint256,uint256)"](2**256 - 1, 1)
 
+        async def test_should_revert_approve_kakarot(self, kakarot, dual_vm_token):
+            evm_error = keccak(b"InvalidStarknetAddress()")[:4]
+            with cairo_error(evm_error):
+                await dual_vm_token.functions["approve(uint256,uint256)"](
+                    kakarot.address, 1
+                )
+
         async def test_allowance_owner_starknet_address(
             self, starknet_token, dual_vm_token, other
         ):