Tadle

Summary

There is no way to set allowance of approved tokens to 0.
This leads to possible unfair conditions for users, and the protocol.

Vulnerability Details

In CapitalPool contract, there is a function approve:

That sets the allowance for token token for TokenManager contract.

However, there is no disapprove function, basically function that sets allowance to 0.

Note that while TokenManager has whitelist functionality, that specify what tokens are allowed to be used in TokenManager, there is no check that token is in whitelist when withdrawing it.

That means that if a token is discovered to be malicious/non-compatible with protocol, there is no way to stop withdrawals of that token, apart from pausing TokenManager as a whole, which is suboptimal.

Impact

If a token is hacked, maliciously updated, or discovered to be unsafe for use in the protocol, there is no way to stop withdrawals of that token.

This opens the possibility for potential hacks that exploit new or discovered vulnerabilities in the token, which could unfairly affect the protocol.

One purely theoretical example is when a token update causes the transfer functionality to break, resulting in the amount transferred not matching the intended amount. This could impact users in two ways: they might either steal from the protocol or have a portion of their tokens frozen in CapitalPool.

Tools Used

Manual Review

Recommendations

There are several ways to mitigate this issue.

• Check if a token is whitelisted on withdrawal.

• Add disapprove function to CapitalPool, with functionality similar to approve, that will set allowance to 0, instead of .