Tadle

Summary

The CapitalPool.solhas an approve method which is intended to make an approve call to approve token manager of some tokens ( determined by token address passed as parameter ). The Function was supposed to be called only by token manager. However , there is no access control on this function .Which is in itself a great problem . Additionally it can lead to devastating effects such as attacker can pass any malicious contract address , and inside a function having same siganture as approve, they can either let the CapitalPool approve the malicious contract of its tokens or just execute arbitrary logic that can affect Capital pool in longer term.

Vulnerability Details

Inside CapitalPool.sol, following is the approve method

The comment @notice only can be called by token managerstates there MUST be access control ensured , however it is not .

Additionally , if we take a look , the contract makes a call to user's passed tokenAddr that has some function with the same selector as Approve.

Any Malicious attacker can craft a contract at token address tokenAddr with a function that mathches the selector

(Same selector does not mean same implementation).

Call the contract and they can perform multiple devasting effects like inside their malicious contract at tokenAddr, they can make some calls to contracts where the involvement of CapitalPool was needed . A creative attacker can exploit it to the fullest.

Impact

Anyone can call approve due to broken access control

Arbitrary token addresses can be called from capital pool due to call to user controlled param

Tools Used

Manual Review

Recommendations

Implement access control that only Token manager can call this method