cw20 allowance expiration can be set to a block height or timestamp in the past

[harryscholes]

Expirations are not validated when allowances are created,

cw-plus/contracts/cw20-base/src/allowances.rs

Line 28 in fa0c5ac

if let Some(exp) = expires {

only when they are used

cw-plus/contracts/cw20-base/src/allowances.rs

Line 95 in fa0c5ac

if a.expires.is_expired(block) {

This is not a huge problem, as the expiration can be updated to a future block height or timestamp, or removed entirely. Should we add validation that the block height or timestamp is in the future when creating a new allowance? Happy to make a PR for this if there is interest.

NB this was found in an audit of Mars protocol in a contract that was forked from the cw-plus cw20-base contract.

[ethanfrey]

Happy for this addition. It seems like it slipped off our plate