Tadle

Summary

The TokenManager::tillIn function, which is responsible for receiving funds into the capital pool, contains a vulnerability that can result in the loss of user funds. The function receives an amount parameter used to transfer ERC20, but native token is sent as msg.value. Although there is a safeguard to prevent accepting msg.value less than amount, any excess msg.value sent above amount is not accounted for, leading to a loss of funds.

Vulnerability Details

The TokenManager::tillIn function is designed to receive funds and update internal accounting accordingly. The function ensures that msg.value is at least equal to amount, but it fails to account for cases where msg.value exceeds amount. Here is the relevant code snippet:

The issue arises because the function only updates the capitalPoolBalance with the value of amount, ignoring any excess funds provided in msg.value. As a result:

1. A user might mistakenly send more native tokens than intended by setting msg.value higher than amount.

2. The function only credits the capitalPoolBalance with the amount parameter, causing any extra funds in msg.value to be effectively lost and unaccounted for.

Impact

This vulnerability can lead to the loss of user funds. Users who mistakenly send more native tokens than specified in the amount parameter will lose the excess funds, as they are not credited to the capital pool or refunded.

The following test case, which can be included in the TokenManager.t.sol, demonstrates the issue:

Tools Used

Manual code review.

Recommendations

To prevent the loss of user funds, the function should be updated to handle cases where msg.value exceeds amount. Two alternatives are illustrated below:

1. Revert transactions when msg.value != _amount

1. Call deposit with {value: msg.value}