MetaMask / MetaMask/metamask-mobile

[Bug]: Earn - Supply USDC allows to customize Approval amount potentially leading to the 2nd transaction to fail

Open
#29,848 0 comments 0 reactions 0 assignees View on GitHub
regression-RC-7.76.0 Sev2-normal team-confirmations type-bug
Dominant language
TypeScript
Stars
3k
Forks
1.7k
Avg merge
1d 14h
Merged PRs (30d)
669

Description

### Describe the bug

Supply USDC allows to customize Approval amount potentially leading to the 2nd transaction to fail, if the user edits the approval amount to a smaller value

### Expected behavior

We shouldn't allow the user to edit the approval amount (at least to a smaller value than the one we intend to supply)?

### Screenshots/Recordings

https://github.com/user-attachments/assets/0b3c1f7e-370f-4613-8552-b5da3c90d67c

### Steps to reproduce

1. Have some USDC in Arbitrum
2. Click Earn
3. Add amount ie 10$
4. Click Approve
5. Edit the approve amount to 1$
6. Confirm
7. Click second transaction
8. See you cannot confirm it as it will fail (the fee is super high because of this other bug https://github.com/MetaMask/metamask-mobile/issues/29847)

### Error messages or log output

```shell

```

### Where was this bug found?

Internal release testing

### Version

7.76.0 but seems it might be in prod if that's enabled there too

### Build number

4829

### Build type

None

### Device

Pixel 6

### Operating system

Android

### Additional context

_No response_

### Severity

_No response_

Contributor guide

Open the contributing guide

Research direction

Start at the Earn flow and reproduce the USDC approval sequence on Arbitrum using the steps in the issue. Check how the approval amount is exposed before the second transaction; done means a user cannot reduce it below the intended supply amount and the follow-up transaction remains confirmable.

Written by the indexing model from the issue text.

Assessment

Tech stack
react-native, typescript
Domain
blockchain, mobile
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.