Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Missing ERC20 Approval in `TokenManager::withdraw` Function Prevents Users from Withdrawing ERC20 Tokens

4lifemen

Summary

The TokenManager::withdraw function fails to ensure that the TokenManager contract has approval from the CapitalPool to transfer ERC20 tokens. This prevents users from successfully withdrawing their ERC20 tokens from the contract.

Vulnerability Details

In the TokenManager::withdraw function, there's an attempt to transfer ERC20 tokens from the CapitalPool to the user without obtaining the necessary approval. This results in failed withdrawals due to insufficient allowance.

function withdraw()
{
...
if (_tokenAddress == wrappedNativeToken) {
...
} else {
/**
* @dev token is ERC20 token
* @dev transfer from capital pool to msg sender
*/
_safe_transfer_from(
_tokenAddress,
capitalPoolAddr,
_msgSender(),
claimAbleAmount
);
}
...
}

The vulnerability is due to the absence of an approval step before the _safe_transfer_from call for ERC20 tokens. For a successful withdrawal, the CapitalPool must approve the TokenManager to transfer tokens on its behalf. This approval is missing in the current implementation.

Proof of Code

Add the following test to the PreMarkets.t.sol contract to demonstrate the issue:

function test_withdraw_ERC20() public {
vm.startPrank(user);
​
preMarktes.createOffer(
CreateOfferParams(
marketPlace,
address(mockUSDCToken),
1000,
0.01 * 1e18,
12000,
300,
OfferType.Ask,
OfferSettleType.Protected
)
);
address stockAddr = GenerateAddress.generateStockAddress(0);
address offerAddr = GenerateAddress.generateOfferAddress(0);
​
preMarktes.closeOffer(stockAddr, offerAddr);
​
vm.expectRevert(Rescuable.TransferFailed.selector);
tokenManager.withdraw(
address(mockUSDCToken),
TokenBalanceType.MakerRefund
);
​
vm.stopPrank();
}

This test demonstrates that the withdrawal fails due to the missing approval.

├─ [0] VM::expectRevert(TransferFailed())
│ └─ ← [Return]
├─ [8862] UpgradeableProxy::withdraw(MockERC20Token: [0xF62849F9A0B5Bf2913b396098F7c7019b51A820a], 4)
│ ├─ [8343] TokenManager::withdraw(MockERC20Token: [0xF62849F9A0B5Bf2913b396098F7c7019b51A820a], 4) [delegatecall]
│ │ ├─ [534] TadleFactory::relatedContracts(4) [staticcall]
│ │ │ └─ ← [Return] UpgradeableProxy: [0x76006C4471fb6aDd17728e9c9c8B67d5AF06cDA0]
│ │ ├─ [2963] MockERC20Token::transferFrom(UpgradeableProxy: [0x76006C4471fb6aDd17728e9c9c8B67d5AF06cDA0], 0x7E5F4552091A69125d5DfCb7b8C2659029395Bdf, 12000000000000000 [1.2e16])
│ │ │ └─ ← [Revert] ERC20InsufficientAllowance(0x6891e60906DEBeA401F670D74d01D117a3bEAD39, 0, 12000000000000000 [1.2e16])
│ │ └─ ← [Revert] TransferFailed()
│ └─ ← [Revert] TransferFailed()
├─ [0] VM::stopPrank()

Impact

The vulnerability prevents users from withdrawing their ERC20 tokens from the CapitalPool through the TokenManager contract. As a result, user funds remain locked in the CapitalPool, and the withdrawal functionality for ERC20 tokens is non-operational.

Tools Used

  • Manual review

  • Foundry

Recommendations

Implement an approval mechanism for the TokenManager to spend tokens on behalf of the CapitalPool before attempting the transfer:

function withdraw(
address _tokenAddress,
TokenBalanceType _tokenBalanceType
) external whenNotPaused {
...
if (_tokenAddress == wrappedNativeToken) {
...
} else {
/**
* @dev token is ERC20 token
* @dev transfer from capital pool to msg sender
*/
+ ICapitalPool(capitalPoolAddr).approve(address(_tokenAddress));
​
_safe_transfer_from(
_tokenAddress,
capitalPoolAddr,
_msgSender(),
claimAbleAmount
);
}
}
Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-TokenManager-approve-wrong-address-input

If we consider the correct permissioned implementation for the `approve()` function within `CapitalPool.sol`, this would be a critical severity issue, because the withdrawal of funds will be permanently blocked and must be rescued by the admin via the `Rescuable.sol` contract, given it will always revert [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/CapitalPool.sol#L36-L38) when attempting to call a non-existent function selector `approve` within the TokenManager contract. The argument up in the air is since the approval function `approve` was made permisionless, the `if` block within the internal `_transfer()` function will never be invoked if somebody beforehand calls approval for the TokenManager for the required token, so the transfer will infact not revert when a withdrawal is invoked. I will leave open for escalation discussions, but based on my first point, I believe high severity is appropriate.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.