Tadle

Summary

TokenManager::tillIn() function operates in two modes based on the tokenAddress passed as parameter. If the tokenAddress passed is for wrappedNativeToken token, then msg.value is relevant for processing. But, if tokenAddress is for other tokens, the msg.value should be 0 as the function will operate only on amount passed a parameter.

Native tokens passed to tillIn() function for not wrappedNativeToken will be deposited into the TokenManager. But, there is no way to retrieve those funds in the current implementation.

As such, the funds will be locked permanently.

Vulnerability Details

Now, refer to the below code snippet, where tillIn(...) function accepts native tokens as well as _amount as parameter. The logic returns incase _amount is 0.

The implementation will result in locking native tokens.

Lets say, the caller makes the below call, where it passes 1 Ether as native token, but passes amount as 0. In that case, 1 Ether will be locked into the contract and the function will execute successfully.

Impact

User's native token will be locked in TokenManger contract.

Tools Used

Manual review

Recommendations

The tillIn(...) should validate the mode of flow. If tokenAddress is wrappedNativeToken , then msg.value should be greater than equal to _amount. Like wise, if the tokenAddress is not wrappedNativeToken, then msg.value should be 0.

these validations should be checked before entry into the logic section of tillIn(...) function.