Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

TokenManager::_transfer call to ICapital.approve will revert

0xrststn

Summary

Function TokenManager::_transfer is used for transferring tokens when tillIn and withdraw functions are invoked. Within _transfer, it is checked if the CapitalPool allowance to TokenManager is zero. In case it is, CapitalPool.approve is called to increase the allowance to type(uint256).max. This called will always revert.
This vulnerability is declared as MEDIUM since, as of now, CapitalPool::approve can be invoked by anyone so there is a way around. In case CapitalPool::approve is modified to have restricted access to TokenManager as NatSpec states, it will have to be considered HIGH since there is no way around.

Vulnerability Details

CapitalPool::approve has one argument address tokenAddr which is the token address to be called for approving tokenManager:

function approve(address tokenAddr) external {
address tokenManager = tadleFactory.relatedContracts(RelatedContractLibraries.TOKEN_MANAGER);
(bool success,) = tokenAddr.call(abi.encodeWithSelector(APPROVE_SELECTOR, tokenManager, type(uint256).max));
​
if (!success) {
revert ApproveFailed();
}
}

TokenManager::_transferhowever invokes approveas follows:

ICapitalPool(_capitalPoolAddr).approve(address(this));

The argument sent to approve is the address of TokenManager. This will try to call approve within TokenManagerand since there is no approve function, it will revert.

PoC

Add this to PreMarkets.t.sol:

function test_withdraw_eth_non_approved() public {
vm.startPrank(user);
preMarktes.createOffer{value: 0.012 * 1e18}(
CreateOfferParams(
marketPlace, address(weth9), 1000, 0.01 * 1e18, 12000, 300, OfferType.Ask, OfferSettleType.Turbo
)
);
vm.stopPrank();
​
deal(user2, 0.006 ether);
vm.startPrank(user2);
address offerAddr = GenerateAddress.generateOfferAddress(0);
preMarktes.createTaker{value: 0.005175 * 1e18}(offerAddr, 500);
​
uint256 userBalance = tokenManager.userTokenBalanceMap(user, address(weth9), TokenBalanceType.SalesRevenue);
assertGt(userBalance, 0);
​
vm.startPrank(user);
vm.expectRevert();
tokenManager.withdraw(address(weth9), TokenBalanceType.SalesRevenue);
}

Tools Used

Foundry

Recommendations

Approve _token instead of address(this):

if (
_from == _capitalPoolAddr &&
IERC20(_token).allowance(_from, address(this)) == 0x0
) {
- ICapitalPool(_capitalPoolAddr).approve(address(this));
+ ICapitalPool(_capitalPoolAddr).approve(_token);
​
}
​
​
Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-TokenManager-approve-wrong-address-input

If we consider the correct permissioned implementation for the `approve()` function within `CapitalPool.sol`, this would be a critical severity issue, because the withdrawal of funds will be permanently blocked and must be rescued by the admin via the `Rescuable.sol` contract, given it will always revert [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/CapitalPool.sol#L36-L38) when attempting to call a non-existent function selector `approve` within the TokenManager contract. The argument up in the air is since the approval function `approve` was made permisionless, the `if` block within the internal `_transfer()` function will never be invoked if somebody beforehand calls approval for the TokenManager for the required token, so the transfer will infact not revert when a withdrawal is invoked. I will leave open for escalation discussions, but based on my first point, I believe high severity is appropriate.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.