Skip to content
medium Token Standards No SWC entry CWE-294

EIP-2612 Permit Misuse / Front-Running

SAFE-0056 Token Standards Checked automatically by the scanner
1

What goes wrong

permit() signatures can be extracted from the mempool and submitted by anyone, or DoS'd by front-running the nonce; integrations that assume the permit caller equals the signer, or do not handle a permit failing because it was already used, can break or be griefed.

2

How to fix it

the pattern that is safe
try token.permit(owner, address(this), v, deadline, vv, rr, ss) {} catch {}
require(token.allowance(owner, address(this)) >= v, "no allowance");
◆
Make permit usage front-run tolerant.
3

Related vulnerabilities in Token Standards

SAFE-0053Unsafe / Unprotected Minting critical · Token Standards SAFE-0051Missing SafeERC20 / Non-Standard Token Handling high · Token Standards SAFE-0052Fee-on-Transfer / Rebasing Token Accounting Mismatch high · Token Standards SAFE-0055Burn Authorization / Burn-From Missing Checks high · Token Standards SAFE-0107Fee-on-Transfer / Rebasing Token Mis-Accounting high · Token Standards SAFE-0208Non-Standard ERC20 Return Value Not Handled high · Token Standards SAFE-0050ERC-20 Approval Race Condition medium · Token Standards SAFE-0054ERC-721/1155 Missing Receiver Validation (Safe Transfer) medium · Token Standards
← PreviousBurn Authorization / Burn-From Missing Checks
Check your own contract for this

The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0056 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.

Run the scanner See how it is attacked Read the docs