Withdraw does not remove the amount from the token balance mapping
Summary
The withdraw function does not remove the amount from the token balance mapping. This allows anyone with a minute balance to spam withdraw to drain the entire contract balance.
Vulnerability Details
The amount is transferred but the balance mapping is not updated.
Impact
Anyone with any balance of Token X can drain the entire contract balance of said token.
Tools Used
Manual Review
Recommendations
Reduce the users balance with the amount withdrawn.
Lead Judging Commences
finding-TokenManager-withdraw-userTokenBalanceMap-not-reset
Valid critical severity finding, the lack of clearance of the `userTokenBalanceMap` mapping allows complete draining of the CapitalPool contract. Note: This would require the approval issues highlighted in other issues to be fixed first (i.e. wrong approval address within `_transfer` and lack of approvals within `_safe_transfer_from` during ERC20 withdrawals)
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.