Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Overlooked Failure in approve Function Due to Low-Level Call

aresaudits

Summary

Vulnerability Details

/**
* @dev Approve token for token manager
* @notice only can be called by token manager
* @param tokenAddr address of token
*/
function approve(address tokenAddr) external {
address tokenManager = tadleFactory.relatedContracts(
RelatedContractLibraries.TOKEN_MANAGER
);
(bool success, ) = tokenAddr.call(
abi.encodeWithSelector(
APPROVE_SELECTOR,
tokenManager,
type(uint256).max
)
);
​
if (!success) {
revert ApproveFailed();
}
}
​

The approve function in CapitalPool.sol uses a low-level call to interact with the tokenAddr address. According to the Solidity documentation, low-level functions (call, delegatecall, and staticcall) return true as their first return value if the account called is non-existent. This behavior can lead to potential overlooked failures in the approve function.

Impact

The low-level call to tokenAddr will return true as the first return value if the tokenAddr is a non-existent address. This means that the success variable will be true, and the function will not detect that the call failed due to the non-existence of the tokenAddr.

Tools Used

Manual Analysis

Recommendations

To mitigate this issue, it is recommended to check if the tokenAddr address is a contract before performing the low-level call. This can be done by checking if the tokenAddr address has code associated with it.

Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Too generic
Assigned finding tags:

[invalid] finding-CapitalPool-approve-return-boolean

Invalid, low level call will always return true as long as the call succeeds without reverting, so this has no impact described, given approvals can only fail when some weird tokens do not allow a uint256.max approval, which is not described in any of the issues below.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.