Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Lack of access control in `CapitalPool:approve` resulting anyone can approve token for token manager

soupy

Summary

Function CapitalPool:approve supposed to be called only by TokenManager according to its natspec. However, there's no access control implemented causing the function can be called by anyone to approve token of their interest.

Vulnerability Details

The natspec in function CapitalPool:approve specifies that only the token manager can call the function. In the code implementaion, there's no access control check resulting the function can be called by anyone to approve token of their interest.

/**
* @dev Approve token for token manager
<@@> ! * @notice only can be called by token manager
* @param tokenAddr address of token
*/
function approve(address tokenAddr) external {
//@audit : no access control to restric function to be called only by token manager
address tokenManager = tadleFactory.relatedContracts(
RelatedContractLibraries.TOKEN_MANAGER
);
(bool success, ) = tokenAddr.call(
abi.encodeWithSelector(
APPROVE_SELECTOR,
tokenManager,
type(uint256).max
)
);
​
if (!success) {
revert ApproveFailed();
}
}

Proof of concept:
In test/PreMarkets.t.sol, add the following test :

function test_audit_capitalPool_approve_anyoneCanApprove() public {
address randomUser = makeAddr("randomUser");
​
vm.prank(randomUser);
capitalPool.approve(address(mockUSDCToken));
}

After forge test run, the test passes indicating that any random user can approve the function CapitalPool:approve

Impact

Anyone can just approve the token of their interest in the CapitalPool contract which could affect the normal functionality and integrity of the other contract that depends on the state of this function.

Tools Used

Manual review with forge test

Recommendations

To implment access control check in the function code:

function approve(address tokenAddr) external {
address tokenManager = tadleFactory.relatedContracts(
RelatedContractLibraries.TOKEN_MANAGER
);
​
+ if (_msgSender() != tokenManager) {
+ revert("Not token manager");
+ }
(bool success, ) = tokenAddr.call(
abi.encodeWithSelector(
APPROVE_SELECTOR,
tokenManager,
type(uint256).max
)
);
​
console.log("success at CapitalPool:approve : ", success);
​
if (!success) {
revert ApproveFailed();
}
}
​
Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-CapitalPool-approve-missing-access-control

This is at most low severity, even though giving max approvals shouldn't be permisionless, the respective tokenManager address is retrieved from the TadleFactory contract whereby the trusted guardian role is responsible for deploying such contracts as seen [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/factory/TadleFactory.sol#L68). Since the user still has to go through the PreMarkets/DeliveryPlace contracts to perform market actions, this max approval cannot be exploited.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.