Tadle
Tadle
DeFi
30,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Users can't withdraw any EVM Native Token like `ether` from the Protocol.

kupiasec

Github link

https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/TokenManager.sol#L137

https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/TokenManager.sol#L247

Summary

Users can withdraw their balance from TokenManager by calling the TokenManager.withdraw() function. However, due to vulnerability to the TokenManager._transfer() function, users who are going to withdraw the EVM Native Token like ether can't withdraw their balance.

Vulnerability Details

Users can withdraw their balance from TokenManager by calling the TokenManager.withdraw() function.
To withdraw ether, users should set _tokenAddress as WETH(wrapped native token).
The vulnerability arises in the _transfer function at L160.

if (_tokenAddress == wrappedNativeToken) {
[...]
L160: _transfer(
wrappedNativeToken,
capitalPoolAddr,
address(this),
claimAbleAmount,
capitalPoolAddr
);

The TokenManager._transfer() function withdraw the wrapped native token to a TokenManager contract from a CapitalPool contract. To do this, the CapitalPool contract should approve the TokenManager contract at L247.

if (
_from == _capitalPoolAddr &&
IERC20(_token).allowance(_from, address(this)) == 0x0
) {
L247 ICapitalPool(_capitalPoolAddr).approve(address(this));
}

However, the parameter of the approve() function is set as an address of the TokenManager contract, not the address of the wrapped native token. As the TokenManager contract does not have the approve() function, it is reverted.

function approve(address tokenAddr) external {
[...]
L28: (bool success, ) = tokenAddr.call(
abi.encodeWithSelector(
APPROVE_SELECTOR,
tokenManager,
type(uint256).max
)
);
L36: if (!success) {
revert ApproveFailed();
}

Impact

Users can't withdraw the EVM Native Token like ether from the Protocol.

Tools Used

Manual Review

Recommendations

It is recommended to change the code as following:

https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/TokenManager.sol#L247

if (
_from == _capitalPoolAddr &&
IERC20(_token).allowance(_from, address(this)) == 0x0
) {
- ICapitalPool(_capitalPoolAddr).approve(address(this));
+ ICapitalPool(_capitalPoolAddr).approve(_token);
}
Updates

Lead Judging Commences

0xnevi Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-TokenManager-approve-wrong-address-input

If we consider the correct permissioned implementation for the `approve()` function within `CapitalPool.sol`, this would be a critical severity issue, because the withdrawal of funds will be permanently blocked and must be rescued by the admin via the `Rescuable.sol` contract, given it will always revert [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/CapitalPool.sol#L36-L38) when attempting to call a non-existent function selector `approve` within the TokenManager contract. The argument up in the air is since the approval function `approve` was made permisionless, the `if` block within the internal `_transfer()` function will never be invoked if somebody beforehand calls approval for the TokenManager for the required token, so the transfer will infact not revert when a withdrawal is invoked. I will leave open for escalation discussions, but based on my first point, I believe high severity is appropriate.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.