Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Missing Access Control Check in approve Function

darshan

Summary

The CapitalPool contract contains an approve function that is intended to allow only the TokenManager to authorize token approvals. However, due to the lack of an explicit access control check, this function can be called by any external account, leading to a potential security vulnerability.

Vulnerability Details

The approve function retrieves the TokenManager address from the TadleFactory contract using the RelatedContractLibraries. However, it does not verify whether the caller (msg.sender) is the authorized TokenManager. This missing check allows any external account to execute the approve function, potentially leading to unauthorized approvals.

https://github.com/Cyfrin/2024-08-tadle/blob/main/src/core/CapitalPool.sol#L24

/**
* @dev Approve token for token manager
* @notice only can be called by token manager
* @param tokenAddr address of token
*/
function approve(address tokenAddr) external {
address tokenManager = tadleFactory.relatedContracts(
RelatedContractLibraries.TOKEN_MANAGER
);
(bool success, ) = tokenAddr.call(
abi.encodeWithSelector(
APPROVE_SELECTOR,
tokenManager,
type(uint256).max
)
);
​
if (!success) {
revert ApproveFailed();
}

Impact

If exploited, this vulnerability could allow a malicious actor to call the approve function and approve an unlimited amount of tokens to any address of their choosing. This could result in unauthorized transfers of tokens and significant financial loss.

Tools Used

Manual Code Review

Recommendations

Add an explicit access control check in the approve function to ensure that only the TokenManager can execute this function.

require(msg.sender == tadleFactory.relatedContracts(RelatedContractLibraries.TOKEN_MANAGER), "Not authorized");
Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-CapitalPool-approve-missing-access-control

This is at most low severity, even though giving max approvals shouldn't be permisionless, the respective tokenManager address is retrieved from the TadleFactory contract whereby the trusted guardian role is responsible for deploying such contracts as seen [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/factory/TadleFactory.sol#L68). Since the user still has to go through the PreMarkets/DeliveryPlace contracts to perform market actions, this max approval cannot be exploited.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.