深入 ERC-20：授權額度、批准，以及其間的漏洞

// The complete ERC-20 surface: 6 functions, 2 events.
interface IERC20 {
    function totalSupply() external view returns (uint256);
    function balanceOf(address account) external view returns (uint256);

    // Direct, self-service transfer (push).
    function transfer(address to, uint256 amount) external returns (bool);

    // The allowance trio that powers the pull model:
    function allowance(address owner, address spender) external view returns (uint256);
    function approve(address spender, uint256 amount) external returns (bool);
    function transferFrom(address from, address to, uint256 amount) external returns (bool);

    event Transfer(address indexed from, address indexed to, uint256 value);
    event Approval(address indexed owner, address indexed spender, uint256 value);
}

// balances and the two-level allowance map
mapping(address => uint256) public balanceOf;
mapping(address => mapping(address => uint256)) public allowance;

function approve(address spender, uint256 amount) public returns (bool) {
    allowance[msg.sender][spender] = amount;          // overwrites any prior value
    emit Approval(msg.sender, spender, amount);
    return true;
}

function transferFrom(address from, address to, uint256 amount) public returns (bool) {
    // msg.sender here is the SPENDER, not the token owner.
    uint256 allowed = allowance[from][msg.sender];
    require(allowed >= amount, "insufficient allowance");

    // Gas optimization: an infinite (max) approval is never decremented,
    // saving an expensive storage write on every pull.
    if (allowed != type(uint256).max) {
        allowance[from][msg.sender] = allowed - amount;   // 0.8 reverts on underflow
    }

    balanceOf[from] -= amount;   // reverts if 'from' is short (Solidity 0.8 checked math)
    balanceOf[to]   += amount;
    emit Transfer(from, to, amount);
    return true;
}

// Differential changes avoid overwriting a live allowance (no race window).
function increaseAllowance(address spender, uint256 added) public returns (bool) {
    allowance[msg.sender][spender] += added;
    emit Approval(msg.sender, spender, allowance[msg.sender][spender]);
    return true;
}

// The safest manual fix from a wallet: zero it out first, THEN set the new value.
//   token.approve(spender, 0);     // tx 1, confirm
//   token.approve(spender, 50);    // tx 2 — no old allowance left to front-run

bytes32 public constant PERMIT_TYPEHASH = keccak256(
    "Permit(address owner,address spender,uint256 value,uint256 nonce,uint256 deadline)"
);
mapping(address => uint256) public nonces;   // one running counter per owner

// Set an allowance from an OFF-CHAIN signature — no prior transaction from the owner.
function permit(
    address owner, address spender, uint256 value,
    uint256 deadline, uint8 v, bytes32 r, bytes32 s
) external {
    require(block.timestamp <= deadline, "permit expired");

    // EIP-712 typed-data hashing; nonces[owner]++ burns this signature after one use.
    bytes32 structHash = keccak256(
        abi.encode(PERMIT_TYPEHASH, owner, spender, value, nonces[owner]++, deadline)
    );
    bytes32 digest = keccak256(abi.encodePacked("\x19\x01", DOMAIN_SEPARATOR, structHash));

    address signer = ecrecover(digest, v, r, s);
    require(signer != address(0) && signer == owner, "invalid signature");

    allowance[owner][spender] = value;
    emit Approval(owner, spender, value);
}

import {SafeERC20} from "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";
import {IERC20}   from "@openzeppelin/contracts/token/ERC20/IERC20.sol";

contract Vault {
    using SafeERC20 for IERC20;

    function pullDeposit(IERC20 token, address user, uint256 amount) external {
        // safeTransferFrom tolerates tokens (like USDT) that return no bool.
        token.safeTransferFrom(user, address(this), amount);
    }

    function approveRouter(IERC20 token, address router, uint256 amount) external {
        // forceApprove first sets the allowance to 0 if needed,
        // handling USDT's "must zero before changing a nonzero approval" rule.
        token.forceApprove(router, amount);
    }
}