Detector: Approval race (approve without zero-first) for SEP-41

[Gbangbolaoluwagbemiga]

Epic: Detectors (wave 3)

Summary

Add a static-analysis detector for approval race (approve without zero-first) for SEP-41.

Background & Problem

Changing an allowance without zeroing first enables the classic approve front-run double-spend.

Acceptance Criteria

• Flags allowance updates lacking zero-first/expiry mitigation.
• Advisory with references.

Technical Notes

Follow the rule pattern in tooling/sanctifier-core/src/rules/ with an insta golden snapshot.

---

Filed as part of the mainnet-readiness & world-class roadmap. Scope is intentionally small enough for one focused PR; comment to claim.

[smnopa]

I have experience developing smart-contract security tooling and static-analysis rules. I would implement a SEP-41 detector that identifies unsafe allowance updates lacking a zero-first or equivalent mitigation, add a concise advisory with references, and cover vulnerable and safe cases with insta golden snapshot tests following the existing rule pattern

[Gbangbolaoluwagbemiga]

GM @smnopa, you are assigned, ensure all CI pipeline passes.

[grantfox-oss]

🦊 GrantFox — @smnopa has been assigned to this issue as part of the Official Campaign | FWC26 campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #806)
2. Your PR will be reviewed by the Centurylong maintainers

Good luck! Track your progress on GrantFox.