Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

The withdraw function cannot operate if the token is the native token.

0xphantom

Summary

When a user has a claimable balance, he call the withdraw function (L-137) in the tokenManager, which transfers the tokens from the capital pool to the msg.sender and calls the approve function in the capital pool, allowing the capital pool to approve itself to transfer the tokens from the capital pool to the sender. However, this call will consistently revert because the capital pool calls the approve function in the tokenManager, which has not implemented this function.

Vulnerability Details

When a user tries to withdraw, the user calls the withdraw function (L-137) in the tokenManager. If the token to be withdrawn is the native token, then the `_transfer` function (L-186) is used, and this block of code will be executed :

if (
​
\_from == \_capitalPoolAddr &&
​
IERC20(\_token).allowance(\_from, address(this)) == 0x0
​
) {
​
ICapitalPool(\_capitalPoolAddr).approve(address(this));
​
}
​

And the approve function (L-24) of the capitalPool will be executed:

function approve(address tokenAddr) external {
address tokenManager = tadleFactory.relatedContracts(
RelatedContractLibraries.TOKEN_MANAGER
);
(bool success, ) = tokenAddr.call(
abi.encodeWithSelector(
APPROVE_SELECTOR,
tokenManager,
type(uint256).max
)
);
​
if (!success) {
revert ApproveFailed();
}
}

But this call will revert because it will perform a low-level call to the tokenManager as the argument used to call approve is address(this) within the tokenManager.

Impact

It will be impossible to withdraw any amount if the token is the native token

Tools Used

Manual Review

Recommendations

Change de _transfer function to approve with the token address like this :

if (_from == _capitalPoolAddr && IERC20(_token).allowance(_from, address(this)) == 0x0) {
ICapitalPool(_capitalPoolAddr).approve(_token);
}
Updates

Lead Judging Commences

0xnevi Lead Judge 12 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-TokenManager-approve-wrong-address-input

If we consider the correct permissioned implementation for the `approve()` function within `CapitalPool.sol`, this would be a critical severity issue, because the withdrawal of funds will be permanently blocked and must be rescued by the admin via the `Rescuable.sol` contract, given it will always revert [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/CapitalPool.sol#L36-L38) when attempting to call a non-existent function selector `approve` within the TokenManager contract. The argument up in the air is since the approval function `approve` was made permisionless, the `if` block within the internal `_transfer()` function will never be invoked if somebody beforehand calls approval for the TokenManager for the required token, so the transfer will infact not revert when a withdrawal is invoked. I will leave open for escalation discussions, but based on my first point, I believe high severity is appropriate.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.