Opus finding
Approve step skipped when approveTo is empty but ERC20 actually requires allowance
mediumbugmedium
- symbiosis/scripts/symbiosis-swap.py:116-121
- symbiosis/references/api-reference.md:38-41
The code relies entirely on the Symbiosis API echoing `approveTo`. The API docs in this PR say 'if present' — but Symbiosis's response always returns `approveTo` regardless of current on-chain allowance (it does not consult the user's allowance). If the API ever omits `approveTo` (or returns null) for an ERC-20 path, the swap will be submitted and revert on-chain (user pays gas). There is also no check of existing allowance to skip a redundant unlimited approval. While the current production behavior likely always includes approveTo, the script has no defensive fallback when src_token != ZERO_ADDR.
Recommendation
When src_token != ZERO_ADDR, either always send an approval (using exact amount), or query existing allowance and approve only if insufficient; do not rely on the API's approveTo presence alone.