Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

_transfer cannot call ICapitalPool(_capitalPoolAddr).approve

p0wd3r

Summary

In TokenManager._transfer, when calling ICapitalPool(_capitalPoolAddr).approve, the parameter should be _token instead of address(this), as address(this) will cause the call to fail.

Vulnerability Details

When CapitalPool has not approved TokenManager in TokenManager._transfer, it will call ICapitalPool(_capitalPoolAddr).approve(address(this));.

https://github.com/Cyfrin/2024-08-tadle/blob/main/src/core/TokenManager.sol#L243-L248

if (
_from == _capitalPoolAddr &&
IERC20(_token).allowance(_from, address(this)) == 0x0
) {
ICapitalPool(_capitalPoolAddr).approve(address(this));
}

The error here is that the parameter for CapitalPool.approve should be the token address instead of the approver's address. And TokenManger does not have the approve selector, so this call will fail.

https://github.com/Cyfrin/2024-08-tadle/blob/main/src/core/CapitalPool.sol#L24-L34

function approve(address tokenAddr) external {
address tokenManager = tadleFactory.relatedContracts(
RelatedContractLibraries.TOKEN_MANAGER
);
(bool success, ) = tokenAddr.call(
abi.encodeWithSelector(
APPROVE_SELECTOR,
tokenManager,
type(uint256).max
)
);

Impact

_transfer cannot complete approve, the tx will revert.

Tools Used

vscode

Recommendations

ICapitalPool(_capitalPoolAddr).approve(address(this));-> ICapitalPool(_capitalPoolAddr).approve(token)

Updates

Lead Judging Commences

0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-TokenManager-approve-wrong-address-input

If we consider the correct permissioned implementation for the `approve()` function within `CapitalPool.sol`, this would be a critical severity issue, because the withdrawal of funds will be permanently blocked and must be rescued by the admin via the `Rescuable.sol` contract, given it will always revert [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/CapitalPool.sol#L36-L38) when attempting to call a non-existent function selector `approve` within the TokenManager contract. The argument up in the air is since the approval function `approve` was made permisionless, the `if` block within the internal `_transfer()` function will never be invoked if somebody beforehand calls approval for the TokenManager for the required token, so the transfer will infact not revert when a withdrawal is invoked. I will leave open for escalation discussions, but based on my first point, I believe high severity is appropriate.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!