Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Missing authorization check in withdraw function, allows unauthorized token withdrawals

0xmilenov

Summary

The withdraw function in the TokenManager contract lacks a proper authorization check, allowing any user to potentially call this function and withdraw tokens, leading to unauthorized token transfers.

Vulnerability Details

In the withdraw function, inside TokenManager, there is no onlyOwner modifier or any other check to ensure that the caller is authorized to perform the withdrawal. This oversight could allow any user to call the function and withdraw tokens, potentially resulting in significant security risks.

/**
* @notice Withdraw
* @dev Caller must be owner
* @param _tokenAddress Token address
* @param _tokenBalanceType Token balance type
*/
function withdraw(
address _tokenAddress,
TokenBalanceType _tokenBalanceType
) external whenNotPaused {
uint256 claimAbleAmount = userTokenBalanceMap[_msgSender()][
_tokenAddress
][_tokenBalanceType];
​
if (claimAbleAmount == 0) {
return;
}
​
address capitalPoolAddr = tadleFactory.relatedContracts(
RelatedContractLibraries.CAPITAL_POOL
);
​
if (_tokenAddress == wrappedNativeToken) {
_transfer(
wrappedNativeToken,
capitalPoolAddr,
address(this),
claimAbleAmount,
capitalPoolAddr
);
​
IWrappedNativeToken(wrappedNativeToken).withdraw(claimAbleAmount);
payable(msg.sender).transfer(claimAbleAmount);

Impact

This missing authorization check could allow any user to withdraw tokens, leading to unauthorized token transfers and potentially severe financial losses.

Tools Used

Imagination

Recommendations

Add an onlyOwner modifier or similar authorization check to the withdraw function to ensure that only the owner or an authorized user can call this function.

Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

[invalid] finding-TokenManager-withdraw-lack-access-control

Invalid, withdrawals are gated to caller context `msg.sender`, not anybody. This acts as the access control and hence "owner", to withdraw collateral/points tokens after finalization of market actions.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.