Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

`TokenManager.withdraw` can be used to steal tokens

zer0

Summary

userTokenBalanceMap isn't updated in TokenManager.withdraw , which results TokenManager.withdraw can be called multiple times, by repeating calling the function, malicious user can steal all the tokens

Vulnerability Details

In userTokenBalanceMap, the function doesn't update userTokenBalanceMap after reading the values in TokenManager.sol#L141-L147.

138 function withdraw(
139 address _tokenAddress,
140 TokenBalanceType _tokenBalanceType
141 ) external whenNotPaused {
142 uint256 claimAbleAmount = userTokenBalanceMap[_msgSender()][
143 _tokenAddress
144 ][_tokenBalanceType]; <<< --- `userTokenBalanceMap` is not updated after read the value
145
146 if (claimAbleAmount == 0) {
147 return;
148 }
149
...
190 }

Impact

userTokenBalanceMap isn't updated in TokenManager.withdraw , which results TokenManager.withdraw can be called multiple times, by repeating calling the function, malicious user can steal all the tokens

Tools Used

VS code

Recommendations

diff --git a/src/core/TokenManager.sol b/src/core/TokenManager.sol
index 1d1b2ea..96619a1 100644
--- a/src/core/TokenManager.sol
+++ b/src/core/TokenManager.sol
@@ -146,6 +146,10 @@ contract TokenManager is
return;
}
+ userTokenBalanceMap[_msgSender()][
+ _tokenAddress
+ ][_tokenBalanceType] = 0;
+
address capitalPoolAddr = tadleFactory.relatedContracts(
RelatedContractLibraries.CAPITAL_POOL
);
Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-TokenManager-withdraw-userTokenBalanceMap-not-reset

Valid critical severity finding, the lack of clearance of the `userTokenBalanceMap` mapping allows complete draining of the CapitalPool contract. Note: This would require the approval issues highlighted in other issues to be fixed first (i.e. wrong approval address within `_transfer` and lack of approvals within `_safe_transfer_from` during ERC20 withdrawals)

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.