Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

TokenManager.withdraw reverts when the token is wrapped native token

ge6a

Summary

The TokenManager contract keeps track of user balances and is responsible for transferring tokens from users to the protocol and from the protocol to the users. The contract itself does not store tokens; they are stored in a separate contract - CapitalPool. In order to transfer tokens from CapitalPool to the respective user, TokenManager needs approval. This is done by calling the approve function on CapitalPool, which accepts the address of the respective token as its only parameter. The problem is that when transferring wrapped native tokens, the TokenManager._transfer() function is called, which incorrectly passes the address of TokenManager to CapitalPool.approve() instead of the address of the respective token, causing the entire withdraw function to revert.

Vulnerability Details

if (
_from == _capitalPoolAddr &&
IERC20(_token).allowance(_from, address(this)) == 0x0
) {
@> ICapitalPool(_capitalPoolAddr).approve(address(this));
}

https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/TokenManager.sol#L243-L248

POC

function test_create_bid_offer_turbo_eth() public {
vm.startPrank(user);
​
preMarktes.createOffer{value: 0.01 * 1e18}(
CreateOfferParams(
marketPlace,
address(weth9),
1000,
0.01 * 1e18,
12000,
300,
OfferType.Bid,
OfferSettleType.Turbo
)
);
​
address offerAddr = GenerateAddress.generateOfferAddress(0);
preMarktes.createTaker{value: 0.006175 * 1e18}(offerAddr, 500);
​
address stock1Addr = GenerateAddress.generateStockAddress(1);
vm.stopPrank();
​
vm.prank(user1);
systemConfig.updateMarket(
"Backpack",
address(mockPointToken),
0.01 * 1e18,
block.timestamp - 1,
3600
);
​
vm.startPrank(user);
mockPointToken.approve(address(tokenManager), 10000 * 10 ** 18);
​
deliveryPlace.settleAskTaker(stock1Addr, 500);
vm.stopPrank();
​
console.log("User balance: %d", tokenManager.userTokenBalanceMap(
address(user),
address(address(weth9)),
TokenBalanceType.RemainingCash
));
​
vm.startPrank(user);
tokenManager.withdraw(address(weth9), TokenBalanceType.RemainingCash); // this will revert
}

Impact

Users will not be able to withdraw the tokens owed to them unless the owner intervenes or someone manually performs the approve action.

Tools

Manual review

Recommendation

Replace address(this) with the address of the respective token

Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-TokenManager-approve-wrong-address-input

If we consider the correct permissioned implementation for the `approve()` function within `CapitalPool.sol`, this would be a critical severity issue, because the withdrawal of funds will be permanently blocked and must be rescued by the admin via the `Rescuable.sol` contract, given it will always revert [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/CapitalPool.sol#L36-L38) when attempting to call a non-existent function selector `approve` within the TokenManager contract. The argument up in the air is since the approval function `approve` was made permisionless, the `if` block within the internal `_transfer()` function will never be invoked if somebody beforehand calls approval for the TokenManager for the required token, so the transfer will infact not revert when a withdrawal is invoked. I will leave open for escalation discussions, but based on my first point, I believe high severity is appropriate.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.