Tadle

Summary

The CapitalPool::approve function is intended to be called only by the TokenManager, as stated in the function's documentation. However, there is no access control check to enforce this restriction. This oversight allows any external address to call the function.

Vulnerability Details

The approve function is designed to approve the TokenManager to spend tokens on behalf of the CapitalPool, facilitating user withdrawals. However, there is no access control check in place to ensure that only the TokenManager can call this function, despite this being a critical requirement as per the function's documentation. The lack of such a check could allow malicious actors to call the function and manipulate token approvals.

Impact

The lack of access control on the approve function could lead to unauthorized token approvals, potentially allowing malicious actors to manipulate token transfers. This could result in significant financial losses for the protocol and its users

Tools Used

Manual code Review

Recommendations

Implement an access control check to ensure that only the TokenManager can call the approve function. This can be done by adding a require statement that checks the caller's address: