Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

`TokenManager::_transfer` Will Always Revert Due to Incorrect Approval Call

4rdiii

[H-02] TokenManager::_transfer Will Always Revert Due to Incorrect Approval Call

Summary

The _transfer function within the TokenManager contract is responsible for transferring funds from the CapitalPool contract to users. For ERC20 tokens, an approval step is necessary before any transfer can occur. However, the current implementation incorrectly calls the approve function on the CapitalPool contract, passing address(this) instead of the correct ERC20 token address. This mistake results in all funds remaining stuck in the CapitalPool, effectively rendering them inaccessible to users.

Vulnerability Details

The _transfer function attempts to approve itself to transfer ERC20 tokens on behalf of the CapitalPool contract. However, it mistakenly uses address(this) as the parameter for the approve function call, instead of the actual ERC20 token address. This incorrect usage prevents the approval from being correctly established, leading to failed transfers.

function _transfer(
address _token,
address _from,
address _to,
uint256 _amount,
address _capitalPoolAddr
) internal {
uint256 fromBalanceBef = IERC20(_token).balanceOf(_from);
uint256 toBalanceBef = IERC20(_token).balanceOf(_to);
​
if (
_from == _capitalPoolAddr &&
IERC20(_token).allowance(_from, address(this)) == 0x0
) {
@> ICapitalPool(_capitalPoolAddr).approve(address(this));
}
​
_safe_transfer_from(_token, _from, _to, _amount);
​
uint256 fromBalanceAft = IERC20(_token).balanceOf(_from);
uint256 toBalanceAft = IERC20(_token).balanceOf(_to);
​
if (fromBalanceAft != fromBalanceBef - _amount) {
revert TransferFailed();
}
​
if (toBalanceAft != toBalanceBef + _amount) {
revert TransferFailed();
}
}

The correct approve function signature expects the ERC20 token address as its parameter, not the TokenManager address.

/**
* @dev Approve token for token manager
* @notice only can be called by token manager
* @param tokenAddr address of token
*/
@> function approve(address tokenAddr) external {
address tokenManager = tadleFactory.relatedContracts(
RelatedContractLibraries.TOKEN_MANAGER
);
(bool success, ) = tokenAddr.call(
abi.encodeWithSelector(
APPROVE_SELECTOR,
tokenManager,
type(uint256).max
)
);
​
if (!success) {
revert ApproveFailed();
}
}

Impact

While the CapitalPool contract is designed to be rescuable, the inability for users to withdraw any tokens due to this bug effectively means the funds are stuck. This situation undermines the trustworthiness of the system and negatively affects user experience.

Proof of Concept

Adding the following test to the existing test suite demonstrates the failure mode:

function test_my_funds_stuck_Wrong_approval() public {
vm.deal(user, 1 ether);
assertEq(address(user).balance, 1 ether);
vm.startPrank(user);
preMarktes.createOffer{value: 0.8 * 1.2 ether}(
CreateOfferParams(
marketPlace,
address(weth9),
1000,
0.8 ether,
12000,
300,
OfferType.Ask,
OfferSettleType.Turbo
)
);
address _stock = GenerateAddress.generateStockAddress(0);
address _offer = GenerateAddress.generateOfferAddress(0);
preMarktes.closeOffer(_stock, _offer);
vm.expectRevert(ICapitalPool.ApproveFailed.selector);
tokenManager.withdraw(address(weth9), TokenBalanceType.MakerRefund);

Tools Used

Manual Review

Recommendations

To resolve this issue, the _transfer function should be corrected to pass the ERC20 token address to the approve function call, rather than address(this). This adjustment ensures that the approval is correctly established, allowing for successful transfers of ERC20 tokens.
This correction ensures that the approve function is called with the correct parameters, allowing for successful ERC20 token transfers and resolving the reported vulnerability.

function _transfer(
address _token,
address _from,
address _to,
uint256 _amount,
address _capitalPoolAddr
) internal {
uint256 fromBalanceBef = IERC20(_token).balanceOf(_from);
uint256 toBalanceBef = IERC20(_token).balanceOf(_to);
​
if (
_from == _capitalPoolAddr &&
IERC20(_token).allowance(_from, address(this)) == 0x0
) {
- ICapitalPool(_capitalPoolAddr).approve(address(this));
+ ICapitalPool(_capitalPoolAddr).approve(_token);
}
​
_safe_transfer_from(_token, _from, _to, _amount);
​
uint256 fromBalanceAft = IERC20(_token).balanceOf(_from);
uint256 toBalanceAft = IERC20(_token).balanceOf(_to);
​
if (fromBalanceAft != fromBalanceBef - _amount) {
revert TransferFailed();
}
​
if (toBalanceAft != toBalanceBef + _amount) {
revert TransferFailed();
}
}
Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-TokenManager-approve-wrong-address-input

If we consider the correct permissioned implementation for the `approve()` function within `CapitalPool.sol`, this would be a critical severity issue, because the withdrawal of funds will be permanently blocked and must be rescued by the admin via the `Rescuable.sol` contract, given it will always revert [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/CapitalPool.sol#L36-L38) when attempting to call a non-existent function selector `approve` within the TokenManager contract. The argument up in the air is since the approval function `approve` was made permisionless, the `if` block within the internal `_transfer()` function will never be invoked if somebody beforehand calls approval for the TokenManager for the required token, so the transfer will infact not revert when a withdrawal is invoked. I will leave open for escalation discussions, but based on my first point, I believe high severity is appropriate.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.