Tadle
Tadle
DeFi
30,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

No user will able to withdraw due to no approval set prior to transfer ERC20 assets

0xaman

Summary

When a user calls the withdraw function to retrieve their assets from the Tadle Protocol, attempting to withdraw an ERC20 token will revert because there is no approval set for tokenManager to transfer tokens from the CapitalPool.

Vulnerability Details

All the user balances are stored in userTokenBalanceMap with the tokenAddress and paymentType. The balance for ERC20 token will also be stored in same way.
However when user need to withdraw their token they will calls the withdraw function:

function withdraw(
address _tokenAddress,
TokenBalanceType _tokenBalanceType
) external whenNotPaused {
uint256 claimAbleAmount = userTokenBalanceMap[_msgSender()][
_tokenAddress
][_tokenBalanceType];
...
} else {
_safe_transfer_from(
_tokenAddress,
capitalPoolAddr,
_msgSender(),
claimAbleAmount
);
}
​
emit Withdraw(
_msgSender(),
_tokenAddress,
_tokenBalanceType,
claimAbleAmount
);
}

In _safe_transfer_from function:

function _safe_transfer_from(
address token,
address from,
address to,
uint256 amount
) internal {
(bool success, ) = token.call(
abi.encodeWithSelector(TRANSFER_FROM_SELECTOR, from, to, amount)
);
​
if (!success) {
revert TransferFailed();
}
}

IT can be seen from above code that there is no approval set for tokenManger to spent token of Capital Pool and approve function inside CapitalPool is supposed to be called via tokenManager contract as mention in @notice comments.

The Following coded POC will help to understand the Issue:

Add following test code to PreMarket.t.sol:

function testTokenManager_ERC20_No_Approval() external {
deal(address(tokenManager), 100 ** 18);
vm.startPrank(user);
​
preMarktes.createOffer{value: 0.012 * 1e18}(
CreateOfferParams(
marketPlace,
address(mockUSDCToken),
1000,
0.01 * 1e18,
12000,
300,
OfferType.Ask,
OfferSettleType.Protected
)
);
​
address offerAddr = GenerateAddress.generateOfferAddress(0);
preMarktes.createTaker{value: 0.005175 * 1e18}(offerAddr, 500);
​
address stock1Addr = GenerateAddress.generateStockAddress(1);
preMarktes.listOffer(stock1Addr, 0.006 * 1e18, 12000);
​
address offer1Addr = GenerateAddress.generateOfferAddress(1);
preMarktes.closeOffer(stock1Addr, offer1Addr);
vm.expectRevert(Rescuable.TransferFailed.selector); // TransferFailed
tokenManager.withdraw(
address(mockUSDCToken),
TokenBalanceType.MakerRefund
);
}

Run with command : forge test --mt testTokenManager_ERC20_No_Approval -vvv.

Note : This finding assume that the approval function in CapitalPool will only be called by tokenManager as stated in @notice comments.

Impact

Due to no approval , The users can not withdraw their ERC20 tokens.

Tools Used

Manual Review

Recommendations

Add following changes will help to fix the Issue:

@@ -172,6 +173,12 @@ contract TokenManager is
* @dev token is ERC20 token
* @dev transfer from capital pool to msg sender
*/
+ if (
+ IERC20(_tokenAddress).allowance(capitalPoolAddr, address(this)) == 0x0
+ ) {
+ ICapitalPool(capitalPoolAddr).approve(_tokenAddress);
+ }
Updates

Lead Judging Commences

0xnevi Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-TokenManager-approve-wrong-address-input

If we consider the correct permissioned implementation for the `approve()` function within `CapitalPool.sol`, this would be a critical severity issue, because the withdrawal of funds will be permanently blocked and must be rescued by the admin via the `Rescuable.sol` contract, given it will always revert [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/CapitalPool.sol#L36-L38) when attempting to call a non-existent function selector `approve` within the TokenManager contract. The argument up in the air is since the approval function `approve` was made permisionless, the `if` block within the internal `_transfer()` function will never be invoked if somebody beforehand calls approval for the TokenManager for the required token, so the transfer will infact not revert when a withdrawal is invoked. I will leave open for escalation discussions, but based on my first point, I believe high severity is appropriate.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.