Tadle

Tadle
DeFiFoundry
27,750 USDC
View results
Submission Details
Severity: low
Invalid

`withdraw` function in `TokenManager` will not work due to a lack of fallback/receive functions

Summary

As the title suggests, withdraw function in TokenManager will not work due to a lack of fallback/receive functions. This will prevent users from withdrawing their balance.

Vulnerability Details

Look at this section of the withdrawfunction:

IWrappedNativeToken(wrappedNativeToken).withdraw(claimAbleAmount); //@audit - shouldn't this have fallback function?
payable(msg.sender).transfer(claimAbleAmount);

When IWrappedNativeToken(wrappedNativeToken).withdraw(claimAbleAmount); is called on a contract like WETH, it burns the claimAbleAmountof WETH tokens and sends the corresponding token amount to the caller (in this case, the TokenManager contract). But, TokenManager or any of the contracts it inherits from, lack the fallback or receive functions of solidity to receive ETH or other native tokens. So, when the WETH contract tries to send it ETH, it will revert as it lacks these necessary Solidity functions to receive ETH or chain native tokens.

Impact

Withdraw function will not work.

Tools Used

Manual review

Recommendations

Add the fallback or receive functions to receive ETH.

Updates

Lead Judging Commences

0xnevi Lead Judge 12 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

[invalid] finding-TokenManager-no-native-ETH-receive

Invalid, TokenManager is the implementation contract of 9the transparent upgradeable proxy, as can seen by the comments [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/proxy/UpgradeableProxy.sol#L15). The receive payable is implemented as seen [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/proxy/UpgradeableProxy.sol#L37)

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.