Tadle
Tadle
DeFi
30,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Smart contract wallets cannot withdraw/rescue native tokens

y0ng0p3

Summary

The protocol is incompatible with smart contract wallets.

Vulnerability Details

The protocol allows users to withdraw their tokens via theTokenManager::withdraw function and rescue them by calling the Rescuable::rescue funciton. Here are the mecanisms used to transfer those funds to the users.

File: src/core/TokenManager.sol#L153-L181
​
if (_tokenAddress == wrappedNativeToken) {
/**
* @dev token is native token
* @dev transfer from capital pool to msg sender
* @dev withdraw native token to token manager contract
* @dev transfer native token to msg sender
*/
_transfer(
wrappedNativeToken,
capitalPoolAddr,
address(this),
claimAbleAmount,
capitalPoolAddr
);
​
IWrappedNativeToken(wrappedNativeToken).withdraw(claimAbleAmount);
@--> payable(msg.sender).transfer(claimAbleAmount);
} else {
/**
* @dev token is ERC20 token
* @dev transfer from capital pool to msg sender
*/
_safe_transfer_from(
_tokenAddress,
capitalPoolAddr,
_msgSender(),
claimAbleAmount
);
}
File: src/utils/Rescuable.sol#L64-L76
​
function rescue(
address to,
address token,
uint256 amount
) external onlyOwner {
if (token == address(0x0)) {
@--> payable(to).transfer(amount);
} else {
_safe_transfer(token, to, amount);
}
​
​
emit Rescue(to, token, amount);
}

As we can see, when it comes to transfer native tokens, those functions use payable(address).transfer(amount) which is not compatible with smart contract wallets.

Impact

Smart contract wallets cannot withdraw/rescue native tokens.

Tools Used

Manual review.

Recommendations

Use payable(address).call{value: amount_to_transfer}("") for native token transfer instead.

Also prevent reentrancy by adding the necessary checks-effects-interractions pattern and reentrancy guard.

Updates

Lead Judging Commences

0xnevi Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

[invalid] finding-TokenManager-withdraw-transfer-2300-gas

Invalid, known issues [Medium-2](https://github.com/Cyfrin/2024-08-tadle/issues/1)

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.