Add try-catch guard around permit to be resistant to front-running

oxen-io · Jul 15, 2024 · 2f89875 · 2f89875
1 parent 484d626
commit 2f89875
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 3 deletions.
diff --git a/contracts/ServiceNodeContribution.sol b/contracts/ServiceNodeContribution.sol
@@ -128,7 +128,10 @@ contract ServiceNodeContribution is Shared {
         bytes32 r,
         bytes32 s
     ) public onlyOperator {
-        IERC20Permit(address(SENT)).permit(msg.sender, address(this), amount, deadline, v, r, s);
+        // NOTE: Try catch makes the code tolerant to front-running, see:
+        // https://github.com/OpenZeppelin/openzeppelin-contracts/blob/05f218fb6617932e56bf5388c3b389c3028a7b73/contracts/token/ERC20/extensions/IERC20Permit.sol#L19
+        IERC20Permit token = IERC20Permit(address(SENT));
+        try token.permit(msg.sender, address(this), amount, deadline, v, r, s) {} catch {}
         contributeOperatorFunds(amount, _blsSignature);
     }
 
@@ -198,7 +201,10 @@ contract ServiceNodeContribution is Shared {
         bytes32 r,
         bytes32 s
     ) public {
-        IERC20Permit(address(SENT)).permit(msg.sender, address(this), amount, deadline, v, r, s);
+        // NOTE: Try catch makes the code tolerant to front-running, see:
+        // `contributeOperatorFundsWithPermit`
+        IERC20Permit token = IERC20Permit(address(SENT));
+        try token.permit(msg.sender, address(this), amount, deadline, v, r, s) {} catch {}
         contributeFunds(amount);
     }
 

diff --git a/contracts/ServiceNodeRewards.sol b/contracts/ServiceNodeRewards.sol
@@ -300,7 +300,10 @@ contract ServiceNodeRewards is Initializable, Ownable2StepUpgradeable, PausableU
         bytes32 r,
         bytes32 s
     ) external whenNotPaused {
-        IERC20Permit(address(designatedToken)).permit(msg.sender, address(this), _stakingRequirement, deadline, v, r, s);
+        // NOTE: Try catch makes the code tolerant to front-running, see:
+        // ServiceNodeContribution.sol
+        IERC20Permit token = IERC20Permit(address(designatedToken));
+        try token.permit(msg.sender, address(this), _stakingRequirement, deadline, v, r, s) {} catch {}
         addBLSPublicKey(blsPubkey, blsSignature, serviceNodeParams, contributors);
     }