Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

User could not withdraw their token after cancel offer with _transfer function.

danielwang8824

Summary

In TokenManager.sol, there is _transfer function. In this function, they call ICapitalPool approve function with wrong parameter. It requires token address, but they called address(this) -> tokenManager. It will occur wrong approve and user could not withdraw because it will occur Insufficient allowance with transfer.

Vulnerability Details

In TokenManager.sol, there is _transfer function.

https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/TokenManager.sol#L243

if (
_from == _capitalPoolAddr &&
IERC20(_token).allowance(_from, address(this)) == 0x0
) {
@>> ICapitalPool(_capitalPoolAddr).approve(address(this));
}

It calls ICapitalPool(_capitalPoolAddr).approve(address(this));

function approve(address tokenAddr) external {
address tokenManager = tadleFactory.relatedContracts(
RelatedContractLibraries.TOKEN_MANAGER
);
(bool success, ) = tokenAddr.call(
abi.encodeWithSelector(
APPROVE_SELECTOR,
tokenManager,
type(uint256).max
)
);

But CapitalPool's approve function require token address parameter, not token manager.

It will occur an error (Insufficient allowance with transfer) so that user could not withdraw their token.

Impact

This is the test code with withdraw.

function test_withdraw_nativetoken_weth() public {
vm.startPrank(user);
​
preMarktes.createOffer{value: 0.012 * 1e18}(
CreateOfferParams(
marketPlace,
address(weth9),
1000,
0.01 * 1e18,
12000,
300,
OfferType.Ask,
OfferSettleType.Turbo
)
);
​
address stock0Addr = GenerateAddress.generateStockAddress(0);
address offer0Addr = GenerateAddress.generateOfferAddress(0);
//
preMarktes.abortAskOffer(stock0Addr, offer0Addr);
​
tokenManager.withdraw(address(weth9), TokenBalanceType.MakerRefund);
}

It expect withdraw function run successfully, but it got fail.

Tools Used

Manual Review

Recommendations

We could fix _transfer function of TokenManager.sol like the below

function _transfer(
address _token,
address _from,
address _to,
uint256 _amount,
address _capitalPoolAddr
) internal {
uint256 fromBalanceBef = IERC20(_token).balanceOf(_from);
uint256 toBalanceBef = IERC20(_token).balanceOf(_to);
​
if (
_from == _capitalPoolAddr &&
IERC20(_token).allowance(_from, address(this)) == 0x0
) {
- ICapitalPool(_capitalPoolAddr).approve(address(this));
+ ICapitalPool(_capitalPoolAddr).approve(address(_token));
}
Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-TokenManager-approve-wrong-address-input

If we consider the correct permissioned implementation for the `approve()` function within `CapitalPool.sol`, this would be a critical severity issue, because the withdrawal of funds will be permanently blocked and must be rescued by the admin via the `Rescuable.sol` contract, given it will always revert [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/CapitalPool.sol#L36-L38) when attempting to call a non-existent function selector `approve` within the TokenManager contract. The argument up in the air is since the approval function `approve` was made permisionless, the `if` block within the internal `_transfer()` function will never be invoked if somebody beforehand calls approval for the TokenManager for the required token, so the transfer will infact not revert when a withdrawal is invoked. I will leave open for escalation discussions, but based on my first point, I believe high severity is appropriate.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.