Tadle
Tadle
DeFi
30,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Offer creators/takers can't withdraw their revenue, due to incorrect approval

dimah7

Summary

Protocol's users, like offer creators or takers, accrue value to their balances, because of tax income, revenue from sales or from refferal bonuses, which are stored in the CapitalPool contract. Later they can withdraw their funds through the TokenManager::withdraw() function by specifying the address of the token and the revenue type. However, because of incorrect approval the call will revert everytime and users won't be able to withdraw their funds.

Vulnerability Details

If we take a more detailed look on the withdraw() function:

function withdraw(
address _tokenAddress,
TokenBalanceType _tokenBalanceType
) external whenNotPaused {
...
if (_tokenAddress == wrappedNativeToken) {
/**
* @dev token is native token
* @dev transfer from capital pool to msg sender
* @dev withdraw native token to token manager contract
* @dev transfer native token to msg sender
*/
_transfer(
wrappedNativeToken,
capitalPoolAddr,
address(this),
claimAbleAmount,
capitalPoolAddr
);
​
IWrappedNativeToken(wrappedNativeToken).withdraw(claimAbleAmount);
payable(msg.sender).transfer(claimAbleAmount);
...
​
function _transfer(
address _token,
address _from,
address _to,
uint256 _amount,
address _capitalPoolAddr
) internal {
...
if (
_from == _capitalPoolAddr &&
IERC20(_token).allowance(_from, address(this)) == 0x0
) {
ICapitalPool(_capitalPoolAddr).approve(address(this));
}
​
_safe_transfer_from(_token, _from, _to, _amount);

It can be observed that, it calls internally _transfer(), which in this case will call CapitalPool::approve to give an approval to the token manager in order to complete the transfer, but if we check the approve function:

function approve(address tokenAddr) external {
address tokenManager = tadleFactory.relatedContracts(
RelatedContractLibraries.TOKEN_MANAGER
);
(bool success, ) = tokenAddr.call(
abi.encodeWithSelector(
APPROVE_SELECTOR,
tokenManager,
type(uint256).max
)
);
...

The accepted parameter should be the token that will be transfered, instead of address(this) (TokenManager). This will result in breaking the approval functionality and subsequently cause the withdraw function to revert.

PoC:

Add the following test in the PreMarkets.t.sol file, and run forge test --mt testWithdraw

function testWithdraw() public {
address alice = makeAddr("Alice");
address bob = makeAddr("Bob");
​
deal(alice, 100000000 * 10 ** 18);
deal(bob, 100000000 * 10 ** 18);
vm.prank(alice);
preMarktes.createOffer{value: 1.2e18}(
CreateOfferParams(
marketPlace,
address(weth9),
1000,
1e18,
12000,
300,
OfferType.Ask,
OfferSettleType.Turbo
)
);
​
vm.prank(bob);
address offerAddr = GenerateAddress.generateOfferAddress(0);
preMarktes.createTaker{value: 1.035e18}(offerAddr, 1000);
assert(weth9.balanceOf(address(capitalPool)) == 1.2e18 + 1.035e18);
​
vm.startPrank(alice);
vm.expectRevert();
tokenManager.withdraw(address(weth9), TokenBalanceType.TaxIncome);
vm.stopPrank();
}

Impact

  • Likelihood: High, as this will happen everytime a user tries to withdraw

  • Impact:

    • As per platform's docs - High, because "There's a severe disruption of protocol functionality or availability". This implementation makes the withdraw function completely unavailable

    • Mitigated to Low, there's a rescue function, so the user's funds will not be completely lost and stuck in the capital pool, but that's not the intended purpose

  • Overall Severity: Medium

Tools Used

Manual Review

Recommendations

Implement the correct parameter:

function _transfer(
address _token,
address _from,
address _to,
uint256 _amount,
address _capitalPoolAddr
) internal {
...
- ICapitalPool(_capitalPoolAddr).approve(address(this));
+ ICapitalPool(_capitalPoolAddr).approve(_token);
...
Updates

Lead Judging Commences

0xnevi Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-TokenManager-approve-wrong-address-input

If we consider the correct permissioned implementation for the `approve()` function within `CapitalPool.sol`, this would be a critical severity issue, because the withdrawal of funds will be permanently blocked and must be rescued by the admin via the `Rescuable.sol` contract, given it will always revert [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/CapitalPool.sol#L36-L38) when attempting to call a non-existent function selector `approve` within the TokenManager contract. The argument up in the air is since the approval function `approve` was made permisionless, the `if` block within the internal `_transfer()` function will never be invoked if somebody beforehand calls approval for the TokenManager for the required token, so the transfer will infact not revert when a withdrawal is invoked. I will leave open for escalation discussions, but based on my first point, I believe high severity is appropriate.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.