Tadle
Tadle
DeFi
30,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Reentrancy attack in CapitalPool::approve function

ghufranhassan1

Summary

A reentrancy attack occurs when a contract calls an external contract, and that external contract makes recursive calls back into the original contract before the first execution is completed

Vulnerability Details

The approve function calls an external contract using call(), which can be exploited if the external contract performs malicious actions during the call.

Impact

Attackers could exploit the vulnerability to manipulate approvals or transfers, potentially leading to unauthorized access to funds.

I created a test file by the name CapitalPool.t.sol in foundry and added mock for MockTokenManager then run forge test and the outcome is as below.

/ SPDX-License-Identifier: MIT
pragma solidity ^0.8.13;
​
import "forge-std/Test.sol";
import "../src/CapitalPool.sol";
import "../src/mocks/MockToken.sol";
import "../src/mocks/MockTokenManager.sol";
​
contract CapitalPoolNegativeTest is Test {
CapitalPool public capitalPool;
MockToken public token;
address public tokenManager;
​
function setUp() public {
token = new MockToken();
tokenManager = address(new MockTokenManager());
capitalPool = new CapitalPool();
​
// Assuming tadleFactory and relatedContracts are properly mocked/set up
// Set tokenManager address in tadleFactory.relatedContracts
}
​
function testReentrancyAttack() public {
// Deploy a malicious token contract that attempts reentrancy
MockToken maliciousToken = new MockToken(); // Assuming reentrancy code in this mock
vm.expectRevert(CapitalPool.ApproveFailed.selector);
capitalPool.approve(address(maliciousToken));
}
​
​
}
​

Outout

Tools Used

Foundry

Recommendations

Use Reentrancy Guard open zeppelin library.

Updates

Lead Judging Commences

0xnevi Lead Judge
11 months ago
0xnevi Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.