Dangerous max approval on transfers, can result in drained capital pool in case of an exploit
Summary
When tokens are transfered from the protocol's funds holder (CapitalPool), the approved amount is settled to max value.
Vulnerability Details
Having hardcoded type(uint256).max approval amount for transfers is dangerous. This introduces a risk in case the protocol contains a bug, where an exploiter can steal funds from the contract. This will allow him to drain an unlimited amount of tokens.
Impact
Low, as it requires a critical exploit to happen, which will allow transfer of funds from Capital pool
Tools Used
Manual Review
Recommendations
Allow only a claimable amount to be approved, instead of max value
Appeal created
finding-CapitalPool-approve-missing-access-control
This is at most low severity, even though giving max approvals shouldn't be permisionless, the respective tokenManager address is retrieved from the TadleFactory contract whereby the trusted guardian role is responsible for deploying such contracts as seen [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/factory/TadleFactory.sol#L68). Since the user still has to go through the PreMarkets/DeliveryPlace contracts to perform market actions, this max approval cannot be exploited.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.