Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect Parameter in TokenManager::_transfer Causes Reversion in Withdrawal Operations

recursiveeth

Summary

The approve function in the CapitalPool contract is designed to accept only one argument—the token address. This address is then used to approve the transfer of tokens from the CapitalPool to the TokenManager:

Vulnerability Details

The approve function in the CapitalPool contract is designed to accept only one argument—the token address. This address is then used to approve the transfer of tokens from the CapitalPool to the TokenManager:

function approve(address tokenAddr) external {
address tokenManager = tadleFactory.relatedContracts(
RelatedContractLibraries.TOKEN_MANAGER
);
(bool success, ) = tokenAddr.call(
abi.encodeWithSelector(
APPROVE_SELECTOR,
tokenManager,
type(uint256).max
)
);
​
if (!success) {
revert ApproveFailed();
}
}
​

However, the TokenManager::_transfer function mistakenly calls this approve function using the TokenManager address instead of the token address. Since the TokenManager does not have an approve function, the call will revert.

Impact

Any withdrawal involving a wrapped native token will fail due to the incorrect parameter being passed, leading to a transaction revert.

Tools Used

Manual review.

Recommendations

Ensure the correct argument—the token address—is passed to the approve function:

- ICapitalPool(_capitalPoolAddr).approve(address(this));
+ ICapitalPool(_capitalPoolAddr).approve(_token);
​
Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-TokenManager-approve-wrong-address-input

If we consider the correct permissioned implementation for the `approve()` function within `CapitalPool.sol`, this would be a critical severity issue, because the withdrawal of funds will be permanently blocked and must be rescued by the admin via the `Rescuable.sol` contract, given it will always revert [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/CapitalPool.sol#L36-L38) when attempting to call a non-existent function selector `approve` within the TokenManager contract. The argument up in the air is since the approval function `approve` was made permisionless, the `if` block within the internal `_transfer()` function will never be invoked if somebody beforehand calls approval for the TokenManager for the required token, so the transfer will infact not revert when a withdrawal is invoked. I will leave open for escalation discussions, but based on my first point, I believe high severity is appropriate.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.