Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect token approval logic in `TokenManager::_transfer`, potentially causing transactions to fail.

v1vah0us3

Description

The approve function in the CapitalPool.sol contract is designed to approve a token for the TokenManager contract to spend:

function approve(address tokenAddr) external {
address tokenManager = tadleFactory.relatedContracts(
RelatedContractLibraries.TOKEN_MANAGER
);
(bool success, ) = tokenAddr.call(
abi.encodeWithSelector(
APPROVE_SELECTOR,
tokenManager,
type(uint256).max
)
);
​
if (!success) {
revert ApproveFailed();
}

Therefore, the correct usage should pass the address of the token and not the address of the TokenManager contract. This is however the case in the TokenManager::_transfer function, see line 247 in TokenManager.sol: ICapitalPool(_capitalPoolAddr).approve(address(this));. In this line, the CapitalPool::approve function is called with address(this), which refers to the TokenManager contract itself, instead of the token's address. This results in the TokenManager contract trying to approve itself rather than the token, causing the approval process to fail.

Impact

Incorrectly approving the TokenManager contract address instead of the token address can result in the TokenManager lacking the necessary permissions to transfer (e.g. withdraw) wrapped nativeToken, leading to failed transactions and operational disruptions. This bug can severely impact the protocol's functionality, causing significant issues in token transfers and other dependent operations.

Tools used

manual review, vscode

Recommended Mitigation

To mitigate this vulnerability, ensure that the CapitalPool::approve function is called with the correct token address. Consider making the following changes to the TokenManager::_transfer function:

function _transfer(
address _token,
address _from,
address _to,
uint256 _amount,
address _capitalPoolAddr
) internal {
uint256 fromBalanceBef = IERC20(_token).balanceOf(_from);
uint256 toBalanceBef = IERC20(_token).balanceOf(_to);
​
if (
_from == _capitalPoolAddr &&
IERC20(_token).allowance(_from, address(this)) == 0x0
) {
- ICapitalPool(_capitalPoolAddr).approve(address(this));
+ ICapitalPool(_capitalPoolAddr).approve(_token);
}
​
_safe_transfer_from(_token, _from, _to, _amount);
​
uint256 fromBalanceAft = IERC20(_token).balanceOf(_from);
uint256 toBalanceAft = IERC20(_token).balanceOf(_to);
​
if (fromBalanceAft != fromBalanceBef - _amount) {
revert TransferFailed();
}
​
if (toBalanceAft != toBalanceBef + _amount) {
revert TransferFailed();
}
}
Updates

Lead Judging Commences

0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-TokenManager-approve-wrong-address-input

If we consider the correct permissioned implementation for the `approve()` function within `CapitalPool.sol`, this would be a critical severity issue, because the withdrawal of funds will be permanently blocked and must be rescued by the admin via the `Rescuable.sol` contract, given it will always revert [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/CapitalPool.sol#L36-L38) when attempting to call a non-existent function selector `approve` within the TokenManager contract. The argument up in the air is since the approval function `approve` was made permisionless, the `if` block within the internal `_transfer()` function will never be invoked if somebody beforehand calls approval for the TokenManager for the required token, so the transfer will infact not revert when a withdrawal is invoked. I will leave open for escalation discussions, but based on my first point, I believe high severity is appropriate.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!