Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Missing accèss control in `CapitalPool::approve`, any user can approve token for token manager

0xrolko

Relevant GitHub Links

https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/CapitalPool.sol#L24

Vulnerability Details

in the @notice documentation of the CapitalPool::approve function, it is require that only token manager can call this function, however there is no restriction in the body of the function that implements this requirement; this leaves free access to any user.

/**
* @dev Approve token for token manager
@> * @notice only can be called by token manager
* @param tokenAddr address of token
*/
function approve(address tokenAddr) external {
address tokenManager = tadleFactory.relatedContracts(
RelatedContractLibraries.TOKEN_MANAGER
);
(bool success, ) = tokenAddr.call(
abi.encodeWithSelector(
APPROVE_SELECTOR,
tokenManager,
type(uint256).max
)
);
if (!success) {
revert ApproveFailed();
}
}

Impact

Any user can call the CapitalPool::approve function and approve any token for token manager.

Tools Used

Fuzz test

Proof of Concept

add this function in the test file and execute it. It will not revert as expected however, it is not a token manager that calls the approve function.

function test_call_approve_in_capital_pool() public {
address bob = vm.addr(10);
address tokenAddr = vm.addr(100);
vm.startPrank(bob);
vm.expectRevert();
capitalPool.approve(tokenAddr);
vm.stopPrank();
}

Recommendations

Add one require line of code in the CapitalPool::approve function as follows:

function approve(address tokenAddr) external {
address tokenManager = tadleFactory.relatedContracts(
RelatedContractLibraries.TOKEN_MANAGER
);
+ require(tokenManager == msg.sender, 'Only token manage can approve');
(bool success, ) = tokenAddr.call(
abi.encodeWithSelector(
APPROVE_SELECTOR,
tokenManager,
type(uint256).max
)
);
​
if (!success) {
revert ApproveFailed();
}
}
Updates

Lead Judging Commences

0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-CapitalPool-approve-missing-access-control

This is at most low severity, even though giving max approvals shouldn't be permisionless, the respective tokenManager address is retrieved from the TadleFactory contract whereby the trusted guardian role is responsible for deploying such contracts as seen [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/factory/TadleFactory.sol#L68). Since the user still has to go through the PreMarkets/DeliveryPlace contracts to perform market actions, this max approval cannot be exploited.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!