attacker can drain all of the protocol funds through TokenManager::withdraw
Summary
Vulnerability Details
in TokenManager::withdraw
attcker can exploit this function by reentrancy due to lack of balance update before transfer is made or nonReentrant modifier, and this will lead to drain all the protocol funds
Impact
loss of funds
Tools Used
Recommendations
set the user balance to zero before transfer is made or add nonReentrant modifier.
Lead Judging Commences
finding-TokenManager-withdraw-userTokenBalanceMap-not-reset
Valid critical severity finding, the lack of clearance of the `userTokenBalanceMap` mapping allows complete draining of the CapitalPool contract. Note: This would require the approval issues highlighted in other issues to be fixed first (i.e. wrong approval address within `_transfer` and lack of approvals within `_safe_transfer_from` during ERC20 withdrawals)
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.