Tadle

Summary

The CapitalPool contract has a critical vulnerability that allows any external address to call the approve function.This can result in unauthorized approvals, leading to loss of control over the token approvals by the contract.

Vulnerability Details

The approve function is documented that only can be called by token manager. The function does not implemente only be callable by a specific address (e.g., the token manager). So the current implementation does not implements this restriction.

https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/CapitalPool.sol#L24

Function: approve(address tokenAddr)

Issue:

• The approve function lacks access control, allowing any external address to call it.

• This can lead to unauthorized addresses approving tokens, potentially resulting in malicious activities.

Impact

The lack of access control in the approve function can have severe consequences, including:

• Unauthorized approvals of tokens.

• Potential loss of control over token approvals by the intended token manager.

• Increased risk of malicious activities, including unauthorized token transfers.

Tools Used

Manual Code Review

Recommendations

• Restrict the approve function to be callable only by the token manager. This can be achieved by adding a require statement to check the caller's address.