Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

CapitalPool: approve() function is lacking access control

flyingbird

Summary

CapitalPool: approve() function does not have any access control in place, hence it is vulnerable to being used in malicious ways.

Vulnerability Details

/**
* @dev Approve token for token manager
* @notice only can be called by token manager // <=@
* @param tokenAddr address of token
*/
function approve(address tokenAddr) external { //<=@ no modifier
address tokenManager = tadleFactory.relatedContracts(
RelatedContractLibraries.TOKEN_MANAGER
);
(bool success, ) = tokenAddr.call( //<=@ Here, directly low-level call to unchecked address
abi.encodeWithSelector(
APPROVE_SELECTOR,
tokenManager,
type(uint256).max
)
);
​
if (!success) {
revert ApproveFailed();
}

The absence of access control opens the door for any malicious user to get approval on a tailored token.

Impact

A malicious token can be injected into the protocol. however, it is of a medium impact as it can not be whitelisted without Tokenmanager approval.

Tools Used

Manual review

Recommendations

Add the following check after L27 in Capitalpool.sol

+ if( _msgSender() != tokenManager ) {
+ revert ApproveFailed();
+ }
Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-CapitalPool-approve-missing-access-control

This is at most low severity, even though giving max approvals shouldn't be permisionless, the respective tokenManager address is retrieved from the TadleFactory contract whereby the trusted guardian role is responsible for deploying such contracts as seen [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/factory/TadleFactory.sol#L68). Since the user still has to go through the PreMarkets/DeliveryPlace contracts to perform market actions, this max approval cannot be exploited.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.