Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Capital pool's `approve` function does not have any access control for making it only callable by token manager

rbserver

Summary

Because the capital pool's approve function does not have any access control, anyone can call such function, and the specification that requires it to be only callable by the token manager is broken. Moreover, if a vulnerability is later found in the token manager so it needs to be replaced, allowing others to call this approve function, just before such token manager is replaced, to make the capital pool to approve such vulnerable token manager to spend all of its tokenAddr balance can cause the capital pool to lose its tokenAddr balance.

Vulnerability Details

Although the following approve function's comment states that it only can be called by token manager, such function does not have any access control for making it only callable by the token manager. In other words, anyone is allowed to call such function.

https://github.com/Cyfrin/2024-08-tadle/blob/c249cdb68c37c47025cdc4c4782c8ee3f20a5b98/src/core/CapitalPool.sol#L19-L39

/**
* @dev Approve token for token manager
@> * @notice only can be called by token manager
* @param tokenAddr address of token
*/
@> function approve(address tokenAddr) external {
address tokenManager = tadleFactory.relatedContracts(
RelatedContractLibraries.TOKEN_MANAGER
);
(bool success, ) = tokenAddr.call(
abi.encodeWithSelector(
APPROVE_SELECTOR,
tokenManager,
type(uint256).max
)
);
​
if (!success) {
revert ApproveFailed();
}
}

Impact

Since anyone can call the approve function, the previously mentioned specification for such function is broken. If a vulnerability is later found in the token manager so it needs to be replaced, allowing others to call this approve function, just before such token manager is replaced, to make the capital pool to approve such vulnerable token manager to spend all of its tokenAddr balance can cause the capital pool to lose its tokenAddr balance.

Tools Used

Manual Review

Recommended Mitigation

The capital pool's approve function can be updated to implement an access control for making it only callable by the token manager.

Updates

Lead Judging Commences

0xnevi Lead Judge 12 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-CapitalPool-approve-missing-access-control

This is at most low severity, even though giving max approvals shouldn't be permisionless, the respective tokenManager address is retrieved from the TadleFactory contract whereby the trusted guardian role is responsible for deploying such contracts as seen [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/factory/TadleFactory.sol#L68). Since the user still has to go through the PreMarkets/DeliveryPlace contracts to perform market actions, this max approval cannot be exploited.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.