Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Lack of Access Control on approve Function

rea

Summary

The approve function lacks access control, allowing anyone to call it and approve tokens to the TokenManager. This coil lead to unauthorised token approvals and potential fund drains.

Vulnerability Details

An attacker could call the approve function, and if they have control over the tokenManager, they could approve the maximum token amount to themselves and then transfer the tokens out.

Impact

Unauthorised approvals could lead to the draining of the contract's tokens. The potential loss is the full amount of tokens held by the contract at the time of the attack.

Tools Used

Manual review

CODE SNIPPET

function approve(address tokenAddr) external {
address tokenManager = tadleFactory.relatedContracts(
RelatedContractLibraries.TOKEN_MANAGER
);
(bool success, ) = tokenAddr.call(
abi.encodeWithSelector(
APPROVE_SELECTOR,
tokenManager,
type(uint256).max
)
);
​
if (!success) {
revert ApproveFailed();
}

Recommendations

Add access control to ensure that only authorised(e.g. the owner or admin) can call the approve function.

function approve(address tokenAddr)
external onlyOwner{
address tokenManager =
tadleFactory.relatedContracts(
​
RelatedContractLibaries.TOKEN_MANAGER
);
​
IERC20(tokenAddr).approve(tokenManager,type(uint256).max);
}
Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-CapitalPool-approve-missing-access-control

This is at most low severity, even though giving max approvals shouldn't be permisionless, the respective tokenManager address is retrieved from the TadleFactory contract whereby the trusted guardian role is responsible for deploying such contracts as seen [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/factory/TadleFactory.sol#L68). Since the user still has to go through the PreMarkets/DeliveryPlace contracts to perform market actions, this max approval cannot be exploited.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.