Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Missing Access Control on `approve`

0xshoonya

Summary

The CapitalPool contract contains an approve function that lacks proper access control, allowing any external actor to approve unlimited spending of any token by the TokenManager.

Vulnerability Details

In the CapitalPool contract, the approve function is intended to be called only by the TokenManager, as indicated by the comment. However, there is no access control implemented:

/**
* @dev Approve token for token manager
* @notice only can be called by token manager
* @param tokenAddr address of token
*/
function approve(address tokenAddr) external {
address tokenManager = tadleFactory.relatedContracts(
RelatedContractLibraries.TOKEN_MANAGER
);
​
(bool success, ) = tokenAddr.call(
abi.encodeWithSelector(
APPROVE_SELECTOR,
tokenManager,
type(uint256).max
)
);
​
if (!success) {
revert ApproveFailed();
}
}

This function allows any caller to approve the TokenManager to spend an unlimited amount (type(uint256).max) of any token held by the CapitalPool.

Impact

Any user can approve the TokenManager to spend tokens from the CapitalPool, which is not the intended behavior.

Tools Used

Manual Review

Recommendations

modifier onlyTokenManager() {
require(msg.sender == tadleFactory.relatedContracts(RelatedContractLibraries.TOKEN_MANAGER), "Only TokenManager can call");
_;
}
​
function approve(address tokenAddr) external onlyTokenManager {
// ... existing code ...
}
Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-CapitalPool-approve-missing-access-control

This is at most low severity, even though giving max approvals shouldn't be permisionless, the respective tokenManager address is retrieved from the TadleFactory contract whereby the trusted guardian role is responsible for deploying such contracts as seen [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/factory/TadleFactory.sol#L68). Since the user still has to go through the PreMarkets/DeliveryPlace contracts to perform market actions, this max approval cannot be exploited.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.