Tadle

Summary

Vulnerability Details

The approve function in the CapitalPool contract lacks proper access control, allowing any address to call it. This function is intended to be called only by the token manager, as indicated by the comment in the code. However, without any restrictions, an attacker can exploit this function to spam the mempool by repeatedly approving the tokenAddr to the tokenManager.

Impact

• An attacker can call the approve function in a loop, creating numerous transactions that approve the tokenAddr to the tokenManager. This can lead to congestion in the Ethereum network's mempool, potentially increasing gas prices and delaying other transactions.

• By spamming the mempool with approval transactions, an attacker can cause a denial of service, making it difficult for legitimate transactions to be processed in a timely manner.

• Even if the tokenManager is trusted, the lack of access control means that any address can call the approve function, leading to unintended approvals. This could result in the CapitalPool contract approving tokens for spending by the tokenManager without proper authorization.

Tools Used

Manual Analysis

Recommendations

To mitigate this issue, implement access control to ensure that only the token manager can call the approve function.