Hacker News Reader

Could someone please explain what's terrifying in the function spendWalletAWETH()?

Just two lines... Is the idea that tokenToBeApproved.allowance() can do bad things?

Code: https://twitter.com/thomasg_eth/status/1492663290715152384/p...

Onlyowner modifier means the contract creator can call this function and transfer all the funds from the victims wallet (if they have previously approved).

Tokentobeapproved is a variable declared in the contract. It will be pointing at the aWETH contract, which is the claim token for ETH on aave, a money market.

Reply on news.ycombinator.com