Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Critical issue in `TokenManager::_transfer` function blocks WETH withdrawals, potentially locking users' funds permanently

0xsecuri

Summary

The TokenManager contract contains a critical issue in the _transfer function. This issue will block the withdrawal logic for WETH, leading to users' funds being locked permanently.

Vulnerability Details

The TokenManager::withdraw function is designed to handle withdrawals for WETH and other ERC20 tokens. The logic for WETH differs from that of other ERC20 tokens. For other ERC20 tokens, the function directly calls Rescuable::_safe_transfer_from to transfer the tokens from the capital pool to the msg.sender. However, for WETH, the function uses the internal TokenManager::_transfer function.

TokenManager.sol#L153-L166

function withdraw(
address _tokenAddress,
TokenBalanceType _tokenBalanceType
) external whenNotPaused {
...
@> if (_tokenAddress == wrappedNativeToken) {
/**
* @dev Token is native.
* @dev Transfer from capital pool to msg sender.
* @dev Withdraw native token to Token Manager contract.
* @dev Transfer native token to msg sender.
*/
@> _transfer(wrappedNativeToken, capitalPoolAddr, address(this), claimAbleAmount, capitalPoolAddr);
​
IWrappedNativeToken(wrappedNativeToken).withdraw(claimAbleAmount);
payable(msg.sender).transfer(claimAbleAmount);
} else {
/**
* @dev Token is ERC20.
* @dev Transfer from capital pool to msg sender.
*/
_safe_transfer_from(_tokenAddress, capitalPoolAddr, _msgSender(), claimAbleAmount);
}
...

However, the _transfer function contains a critical issue that blocks withdrawals. Here’s how this issue arises:

In case users want to withdraw their WETH in the _transfer function, the _from address == capitalPool, which means that we will enter the if statement intended to give approval from CapitalPool to TokenManager. This approval is necessary for TokenManager to call _safe_transfer_from and complete the transfer. However, the function incorrectly passes address(this) instead of the _token (WETH address) to the CapitalPool's approve function. As a result, it attempts to call the approve function on TokenManager, which does not exist. Consequently, the transaction reverts because the if (!success) check in the CapitalPool::approve function evaluates to true.

TokenManager.sol#L233-L250

function _transfer(address _token, address _from, address _to, uint256 _amount, address _capitalPoolAddr)
internal
{
uint256 fromBalanceBef = IERC20(_token).balanceOf(_from);
uint256 toBalanceBef = IERC20(_token).balanceOf(_to);
​
if (_from == _capitalPoolAddr && IERC20(_token).allowance(_from, address(this)) == 0x0) {
@> ICapitalPool(_capitalPoolAddr).approve(address(this)); // @audit-issue wrong argument, we should pass the token address here
}
​
_safe_transfer_from(_token, _from, _to, _amount);
...
}

CapitalPool.sol#L24-L40

function approve(address tokenAddr) external {
address tokenManager = tadleFactory.relatedContracts(RelatedContractLibraries.TOKEN_MANAGER);
(bool success,) = tokenAddr.call(abi.encodeWithSelector(APPROVE_SELECTOR, tokenManager, type(uint256).max));
@> if (!success) {
@> revert ApproveFailed();
}
}

PoC Test

The following PoC demonstrates this issue.

Note that I modified the createOffer function to return the stock and offer addresses, which are used for closing the offer and enabling the withdrawal of the deposited amount. The updated function is as follows:

+ function createOffer(CreateOfferParams calldata params) external payable returns (address, address) {
...
emit CreateOffer(
offerAddr, makerAddr, stockAddr, params.marketPlace, _msgSender(), params.points, params.amount
);
​
+ return (stockAddr, offerAddr);
}

CMD to run the test: forge test --mt test_PermanentWithdrawalDoSForWeth --via-ir -vv

function test_PermanentWithdrawalDoSForWeth() public {
vm.startPrank(user);
(address _stockAddr, address _offer) = preMarktes.createOffer{value: 12 * 1e18}(
CreateOfferParams(
marketPlace, address(weth9), 1000, 0.01 * 1e18, 12000, 300, OfferType.Ask, OfferSettleType.Turbo
)
);
preMarktes.closeOffer(_stockAddr, _offer);
tokenManager.withdraw(address(weth9), TokenBalanceType.MakerRefund);
vm.stopPrank();
}

Console output:

Ran 1 test suite in 498.15ms (26.95ms CPU time): 0 tests passed, 1 failed, 0 skipped (1 total tests)
​
Failing tests:
Encountered 1 failing test in test/PreMarkets.t.sol:PreMarketsTest
[FAIL. Reason: ApproveFailed()] test_PermanentWithdrawalDoSForWeth() (gas: 640563)

Impact

Users won't be able to withdraw their funds, and they will be permanently locked within the contract.

Tools Used

VSCode, Foundry

Recommendations

The approve function should be called with the actual token address. Update the _transfer function to correctly pass the token address.

if (_from == _capitalPoolAddr && IERC20(_token).allowance(_from, address(this)) == 0x0) {
- ICapitalPool(_capitalPoolAddr).approve(address(this));
+ ICapitalPool(_capitalPoolAddr).approve(_token);
}
Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-TokenManager-approve-wrong-address-input

If we consider the correct permissioned implementation for the `approve()` function within `CapitalPool.sol`, this would be a critical severity issue, because the withdrawal of funds will be permanently blocked and must be rescued by the admin via the `Rescuable.sol` contract, given it will always revert [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/CapitalPool.sol#L36-L38) when attempting to call a non-existent function selector `approve` within the TokenManager contract. The argument up in the air is since the approval function `approve` was made permisionless, the `if` block within the internal `_transfer()` function will never be invoked if somebody beforehand calls approval for the TokenManager for the required token, so the transfer will infact not revert when a withdrawal is invoked. I will leave open for escalation discussions, but based on my first point, I believe high severity is appropriate.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.