Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

User could not withdraw their ERC20 token

danielwang8824

Summary

When user create an offer and cancel, user could withdraw their token with TokenManager's withdraw function.

But there is no approve token function call when _tokenAddress != wrappedNativeToken ( https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/TokenManager.sol#L92 else case), It will occur wrong approve and user could not withdraw because it will occur Insufficient allowance with transfer.

Vulnerability Details

In TokenManager.sol, there is withdraw function.

https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/TokenManager.sol#L170

It call _safe_transfer_from function that will transfer token from capitalPoolAddr to msgSender().

But there is no approve before transfer token. It will occur an error so that user could not their token always.

Impact

This unit test code expect run successfully with withdraw function but it got fail.

function test_withdraw_erc20_usdc() public {
vm.startPrank(user);
preMarktes.createOffer(
CreateOfferParams(
marketPlace,
address(mockUSDCToken),
1000,
0.01 * 1e18,
12000,
300,
OfferType.Ask,
OfferSettleType.Protected
)
);
address stock0Addr = GenerateAddress.generateStockAddress(0);
address offer0Addr = GenerateAddress.generateOfferAddress(0);
preMarktes.abortAskOffer(stock0Addr, offer0Addr);
​
tokenManager.withdraw(address(mockUSDCToken), TokenBalanceType.MakerRefund);
}

Tools Used

Manual Review

Recommendations

We could fix withdraw function of TokenManager.sol like the below.

function withdraw(
address _tokenAddress,
TokenBalanceType _tokenBalanceType
) external whenNotPaused {
...
​
if (_tokenAddress == wrappedNativeToken) {
...
} else {
+ if (
+ IERC20(_tokenAddress).allowance(capitalPoolAddr, address(this)) == 0x0
+ ) {
+ ICapitalPool(capitalPoolAddr).approve(address(_tokenAddress));
+ }
/**
* @dev token is ERC20 token
* @dev transfer from capital pool to msg sender
*/
_safe_transfer_from(
_tokenAddress,
capitalPoolAddr,
_msgSender(),
claimAbleAmount
);
}
...
}
​
Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-TokenManager-safeTransferFrom-withdraw-missing-approve

This issue's severity has similar reasonings to #252, whereby If we consider the correct permissioned implementation for the `approve()` function within `CapitalPool.sol`, this would be a critical severity issue, because the withdrawal of funds will be permanently blocked and must be rescued by the admin via the `Rescuable.sol` contract, given it will always revert [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/CapitalPool.sol#L36-L38) when attempting to call a non-existent function selector `approve` within the TokenManager contract. Similarly, the argument here is the approval function `approve` was made permisionless, so if somebody beforehand calls approval for the TokenManager for the required token, the transfer will infact not revert when a withdrawal is invoked. I will leave open for escalation discussions, but based on my first point, I believe high severity is appropriate. It also has a slightly different root cause and fix whereby an explicit approval needs to be provided before a call to `_safe_transfer_from()`, if not, the alternative `_transfer()` function should be used to provide an approval, assuming a fix was implemented for issue #252

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.