Tadle

Summary

The CapitalPool::approve function currently allows any user to call it and specify an arbitrary contract address to be called. Although the intention is for this function to be callable only by the TokenManager, the current implementation does not enforce this restriction. This oversight poses a security risk, as a malicious contract could exploit this function to harm the Tadle system and its users.

Vulnerability Details

The approve function in the CapitalPool contract is designed to set an unlimited approval for the TokenManager. The function is as follows:

Expected Behavior

The function should only be callable by the TokenManager. This security measure prevents unauthorized access and potential exploitation by malicious actors. As indicated by the comment:

Actual Behavior

Currently, the function can be called by any user, as there is no access control mechanism in place. This allows anyone to specify an arbitrary contract address, which could undermine the protocol's security model and potentially lead to unexpected behaviors and vulnerabilities.

Impact

The function's lack of access control means that anyone can call it, despite it being intended for use only by the TokenManager. This could result in a malicious actor providing the address of a malicious contract, which could then harm the Tadle system and its users.

Tools Used

VSCode

Recommendations

Create an access control modifier to restrict the callability of the function to only the TokenManager, as intended.