Tadle
Tadle
DeFi
30,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

leftOver tokens might be stuck in TokenManager

dinkras

Summary

Leftover tokens might be stuck in TokenManager

Vulnerability Details

In case TokenManager.tillIn() is called, some user ETH might be stuck into the TokenManager contract directly. They won't be accounted as a deposit and the user won't be able to withdraw them.

function tillIn(// TOKEN: msg.sender -> capital pool
address _accountAddress,
address _tokenAddress,
uint256 _amount,
bool _isPointToken
)
external
payable
onlyRelatedContracts(tadleFactory, _msgSender())
onlyInTokenWhiteList(_isPointToken, _tokenAddress)//points tokens don't need to be whitelisted
{
// skipped code above
if (msg.value < _amount) {
revert Errors.NotEnoughMsgValue(msg.value, _amount);
}
IWrappedNativeToken(wrappedNativeToken).deposit{value: _amount}();//@audit-issue leftOver tokens stuck
_safe_transfer(wrappedNativeToken, capitalPoolAddr, _amount);//@audit-issue leftOver tokens stuck

This is because _amount is used as a param to deposit() and _safe_transfer(), instead of msg.value

Impact

User's loss of ETH which cannot be recovered by them

Tools Used

Manual review

Recommendations

Modify those line in https://github.com/Cyfrin/2024-08-tadle/blob/main/src/core/TokenManager.sol#L89-L90

- IWrappedNativeToken(wrappedNativeToken).deposit{value: _amount}();
- _safe_transfer(wrappedNativeToken, capitalPoolAddr, _amount);/
​
+ IWrappedNativeToken(wrappedNativeToken).deposit{value: msg.value}();
+ _safe_transfer(wrappedNativeToken, capitalPoolAddr, msg.value);/
Updates

Lead Judging Commences

0xnevi Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

[invalid] finding-TokenManager-tillin-excess

Invalid, these are by default, invalid based on codehawks [general guidelines](https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity#findings-that-may-be-invalid). The check implemented is simply a sufficiency check, it is users responsibility to only send an appropriate amount of native tokens where amount == msg.value when native token is intended to be used as collateral (which will subsequently be deposited as wrapped token). All excess ETH can be rescued using the `Rescuable.sol` contract. > Users sending ETH/native tokens > If contracts allow users to send tokens acc111identally.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.