Tadle
Tadle
DeFi
30,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

onlyInTokenWhitelist can be bypassed as _isPointToken flag set by user

abaikunanbaev

Summary

In TokenManagersmart contract,when transferring tokens from msg.senderto CapitalPooladdress, the user has to provide certain params. One of the params is _isPointToken that's a boolean value and is set by user. The problem is that this value is checked when checking for token whitelist and as the param is user-provided, it can be easily bypassed.

Vulnerability Details

Take a look at the onlyInTokenWhiteList()functionality:

https://github.com/Cyfrin/2024-08-tadle/blob/main/src/core/TokenManager.sol#L30-36

modifier onlyInTokenWhiteList(bool _isPointToken, address _tokenAddress) {
if (!_isPointToken && !tokenWhiteListed[_tokenAddress]) {
revert TokenIsNotWhiteListed(_tokenAddress);
}
​
_;
}

It checks whether the token is point token and whether it's whitelisted. The problem is that the _isPointToken value is provided by user:

function tillIn(
address _accountAddress,
address _tokenAddress,
uint256 _amount,
bool _isPointToken
)
external
payable
onlyRelatedContracts(tadleFactory, _msgSender())
onlyInTokenWhiteList(_isPointToken, _tokenAddress)
{

So the whitelist can be easily bypassed if the _isPointTokenset to true.

Impact

User can bypass whitelist check as the flag is set by the user himself.

Tools Used

Manual review.

Recommendations

Check for point token should be made by smart contract and should not be a user-provided parameter.

Updates

Lead Judging Commences

0xnevi Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

[invalid] finding-TokenManager-onlyInTokenWhiteList-bypass

Invalid, point tokens need not be whitelisted, since they are subjected to the free market to allow free trading within Tadle with the original collateral backing. Since collateral tokens are the subject of focus when valuing points traded, the whitelist is only applicable to them.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.