Tadle

Tadle
DeFi
30,000 USDC
View results
Submission Details
Severity: high
Valid

Reentrancy in withdraw() function

Summary

Vulnerability Details

A potential re-entrancy vulnerability exists in the withdraw function of the TokenManager.sol contract. This vulnerability can be exploited by malicious actors to withdraw more funds than they are entitled to, leading to significant financial loss.

The vulnerability is located in the following block of code within the withdraw function:

function withdraw(
address _tokenAddress,
TokenBalanceType _tokenBalanceType
) external whenNotPaused {
uint256 claimAbleAmount = userTokenBalanceMap[_msgSender()][
_tokenAddress
][_tokenBalanceType];
if (claimAbleAmount == 0) {
return;
}
address capitalPoolAddr = tadleFactory.relatedContracts(
RelatedContractLibraries.CAPITAL_POOL
);
if (_tokenAddress == wrappedNativeToken) {
/**
* @dev token is native token
* @dev transfer from capital pool to msg sender
* @dev withdraw native token to token manager contract
* @dev transfer native token to msg sender
*/
_transfer(
wrappedNativeToken,
capitalPoolAddr,
address(this),
claimAbleAmount,
capitalPoolAddr
);
IWrappedNativeToken(wrappedNativeToken).withdraw(claimAbleAmount);
payable(msg.sender).transfer(claimAbleAmount);//@audit-reentrancy
} else {
/**
* @dev token is ERC20 token
* @dev transfer from capital pool to msg sender
*/
_safe_transfer_from(
_tokenAddress,
capitalPoolAddr,
_msgSender(),
claimAbleAmount
);
}
emit Withdraw(
_msgSender(),
_tokenAddress,
_tokenBalanceType,
claimAbleAmount
);
}

The issue arises because the contract transfers Ether to the caller (msg.sender) before updating the state to reflect the withdrawal. An attacker could exploit this by re-entering the withdraw function before the state is updated, allowing them to withdraw more funds than they are entitled to.

Scenario:

  1. Initial State:

    • userTokenBalanceMap[attacker][wrappedNativeToken][balanceType] = 10 ETH

  2. Attack Execution:

    • The attacker calls the withdraw function to withdraw 10 ETH.

    • The contract transfers 10 ETH to the attacker.

    • Before the state is updated, the attacker re-enters the withdraw function.

    • The contract transfers another 10 ETH to the attacker.

    • This process can be repeated multiple times, draining the contract's funds.

Impact

attackers can withdraw more funds than they are entitled to

Tools Used

Recommendations

To mitigate this vulnerability, follow the Checks-Effects-Interactions pattern. Update the state before transferring funds to prevent re-entrancy attacks

Updates

Lead Judging Commences

0xnevi Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-TokenManager-withdraw-userTokenBalanceMap-not-reset

Valid critical severity finding, the lack of clearance of the `userTokenBalanceMap` mapping allows complete draining of the CapitalPool contract. Note: This would require the approval issues highlighted in other issues to be fixed first (i.e. wrong approval address within `_transfer` and lack of approvals within `_safe_transfer_from` during ERC20 withdrawals)

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.