What happens if `transferFrom` fails after `approve` (Risk of remaining allowance)

Question

I'm trying to call Uniswap V2 addLiquidity function, which calls transferFrom internally, and therefore approve must be called beforehand.

I would like to do it from a TypeScript code. In that case, it calls approve in the first transaction, and then calls addLiquidity in the second transaction. My question is what happens if the second transaction is failed due to some reasons, such as network trouble or insufficient ETH? Is there a risk that the allowance will remain and be exploited?

I found this code is taking the two transactions approach. Maybe not a good approach?

await token1.approve(routerContract.address, amountIn1);
await token2.approve(routerContract.address, amountIn2);

await routerContract.addLiquidity(
      address1, address2, amountIn1, amountIn2, amount1Min, amount2Min, account, deadline
    );

Can I avoid this kind of complication without writing a Solidity code?

Answer 1

No risk for it to be exploited since approve function takes your address (i.e. the message sender), and those 2 arguments that you passed in when calling the function (i.e routerContract.address and amountIn1) to mark into the approved ERC20 that the uniswap router can use amountIn1 of your tokens. Not anyone can use it, only the uniswap router.

So you can call the second function one block after calling the approve function, or 1000 blocks after calling it.

There is no reason to fear someone exploiting the Uniswap protocol to somehow exploit your approve of.

Answer 2

It is good practice to set the approval back to 0 if a call fail.

Some Defi protocol will require you to set the allowance back to 0 after your call.