# Approved address can approve other addresses for an owner's safe

Open Dollar's allowSAFE uses safeAllowed modifier, letting an approved address grant further approvals on the owner's safe, escalating permissions unexpectedly.

- Payout: Contest reward
- Severity: medium
- Program: Open Dollar
- Credited: MrPotatoMagic
- Disclosed: 2023-12-20
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-10-opendollar-findings/issues/171
- Library page: https://bugbountylibrary.com/r/c4%3A2023-10-opendollar%3AM-12
- Tags: domain:web3 impact:privesc kind:contest platform:code4rena sev:medium technique:source-review vuln:access-control

**Target:** ODSafeManager.sol allowSAFE function
**Root cause:** The safeAllowed modifier permits any approved address (not just the owner) to call allowSAFE, allowing them to grant approvals to arbitrary addresses.
**Steps:**
1. Owner calls `allowSAFE(_safe, address(0x01), 1)` to approve 0x01.
2. 0x01 calls `allowSAFE(_safe, address(0x02), 1)`.
3. Modifier safeAllowed checks `msg.sender != _owner && safeCan[_owner][_safe][msg.sender] == 0`; for 0x01, first condition true, second false, so no revert.
4. 0x02 now has approval for the owner's safe.
**How found:** The auditor reviewed the allowSAFE function and its modifier, noticing that the modifier only checks if msg.sender is owner or approved, not restricting approval-granting to the owner alone.
**Exploitation:** An approved address (0x01) can call allowSAFE to grant permissions to another address (0x02) without the owner's consent, potentially allowing 0x02 to perform actions on the safe. However, exploitation requires the owner to have granted approval to a malicious address initially.
**Insight:** When designing permission modifiers, distinguish between roles: actions that grant permissions should typically be restricted to the owner, not to any approved address. Check if modifiers intended for one function are reused in functions with different privilege requirements.