Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

`TokenManager.withdraw()` doesn't reset user balances after a withdrawal.

bladesec

Summary

The withdraw() function doesn't reset the userTokenBalanceMap after a withdrawal.

Vulnerability Details

After users withdraw funds using withdraw(), it doesn't reset userTokenBalanceMap.

function withdraw(
address _tokenAddress,
TokenBalanceType _tokenBalanceType
) external whenNotPaused {
uint256 claimAbleAmount = userTokenBalanceMap[_msgSender()][
_tokenAddress
][_tokenBalanceType];
​
if (claimAbleAmount == 0) {
return;
}
​
}

So users can claim multiple times as long as the capital pool has enough funds.

Impact

Users could withdraw all funds from the capital pool.

Tools Used

Manual Review

Recommendations

withdraw() should reset userTokenBalanceMap after a withdrawal.

Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-TokenManager-withdraw-userTokenBalanceMap-not-reset

Valid critical severity finding, the lack of clearance of the `userTokenBalanceMap` mapping allows complete draining of the CapitalPool contract. Note: This would require the approval issues highlighted in other issues to be fixed first (i.e. wrong approval address within `_transfer` and lack of approvals within `_safe_transfer_from` during ERC20 withdrawals)

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.