Tadle
Tadle
DeFi
30,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Passing TokenManager's address to CapitalPool::approve() as a parameter revert in case of wrappedNativeToken in TokenManger::withdraw().

sakar

Summary

Passing TokenManager's address to CapitalPool::approve() as a parameter always revert in case of wrappedNativeToken in TokenManger::withdraw().

Vulnerability Details

https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/TokenManager.sol#L243C1-L248C10

When TokenManager::_transfer() is called in TokenManager::withdraw(), It always reverts in case of wrappedNativeToken.
From TokenManager::_transfer():

...
if (_from == _capitalPoolAddr && IERC20(_token).allowance(_from, address(this)) == 0x0) {
ICapitalPool(_capitalPoolAddr).approve(address(this));
}
...

Passing TokenManager's address to CapitalPool::approve() as a parameter always reverts because there is no approve function in the TokenManager contract. Also, no fallback or receive function exists in the TokenManager contract. In fact, TokenManager is not even a token address, the CapitalPool::approve() function expects.
We can see the CapitalPool::approve() function:

function approve(address tokenAddr) external {
...
(bool success, ) = tokenAddr.call(
abi.encodeWithSelector(
APPROVE_SELECTOR,
tokenManager,
type(uint256).max
)
);
...
}

Also, APPROVE_SELECTOR is defined in CapitalPool as:

bytes4 private constant APPROVE_SELECTOR =
bytes4(keccak256(bytes("approve(address,uint256)")));

As, this CapitalPool::approve() is used to approve the TokenMangerContract to be the spender to use the asset it has. Also, this approve() function expects to be the token address (such as the ERC20 smart contract address).

But when the TokenManager::withdraw() function is called, TokenManager can not transfer the token from CapitalPool to user because it always reverts.

Severity: High

Impact: High
Likelihood: High

Tools Used

Manual audit

Recommendations

In TokenManager::_transfer(),

if (_from == _capitalPoolAddr && IERC20(_token).allowance(_from, address(this)) == 0x0) {
- ICapitalPool(_capitalPoolAddr).approve(address(this));
+ ICapitalPool(_capitalPoolAddr).approve(_token);
}
Updates

Lead Judging Commences

0xnevi Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-TokenManager-approve-wrong-address-input

If we consider the correct permissioned implementation for the `approve()` function within `CapitalPool.sol`, this would be a critical severity issue, because the withdrawal of funds will be permanently blocked and must be rescued by the admin via the `Rescuable.sol` contract, given it will always revert [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/CapitalPool.sol#L36-L38) when attempting to call a non-existent function selector `approve` within the TokenManager contract. The argument up in the air is since the approval function `approve` was made permisionless, the `if` block within the internal `_transfer()` function will never be invoked if somebody beforehand calls approval for the TokenManager for the required token, so the transfer will infact not revert when a withdrawal is invoked. I will leave open for escalation discussions, but based on my first point, I believe high severity is appropriate.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.