Description

While depositing ERC-20 tokens to the vault, the contract first approves the token to the vault using safeApprove from the solmate library and then calls deposit on the earthquake vault in a try-catch. The code is as follows:

function _depositToVault(
        uint256 id,
        uint256 amount,
        address inputToken,
        address vaultAddress
    ) internal returns (bool) {
        if (inputToken == sgEth) {
            try
                IEarthquake(vaultAddress).depositETH{value: amount}(
                    id,
                    address(this)
                )
            {} catch {
                return false;
            }
        } else {
            ERC20(inputToken).safeApprove(address(vaultAddress), amount);
            try
                IEarthquake(vaultAddress).deposit(id, amount, address(this))
            {} catch {
                return false;
            }
        }
        return true;
    }

If the call to deposit on the earthquake vault fails, it would be caught using the catch statement and the function would simply return false. In this case, the approval would not be decreased as the tokens would not be transferred to the earthquake vault. If this token is USDT, subsequent calls to safeApprove will revert, as USDT's approve function reverts if the current allowance is nonzero.

Impact

USDT deposits to the earthquake vault might fail in case any deposit to the vault fails.

Recommendations

Consider changing the code to the following:

function _depositToVault(
        uint256 id,
        uint256 amount,
        address inputToken,
        address vaultAddress
    ) internal returns (bool) {
        if (inputToken == sgEth) {
            try
                IEarthquake(vaultAddress).depositETH{value: amount}(
                    id,
                    address(this)
                )
            {} catch {
                return false;
            }
        } else {
+           ERC20(inputToken).safeApprove(address(vaultAddress), 0);            
            ERC20(inputToken).safeApprove(address(vaultAddress), amount);
            try
                IEarthquake(vaultAddress).deposit(id, amount, address(this))
            {} catch {
                return false;
            }
        }
        return true;
    }

Remediation

This issue has been acknowledged by Y2K Finance, and a fix was implemented in commit d17e221↗.