When calling the withdraw
with the native token, users can't withdraw due to the wrong parameter being set here.
Notice that the parameter being passed to approve
is the address(this)
. But this parameter is expected to be the token address, not the receiver:
Due to the TokenManager
being passed instead of the native token address, the call will revert with ApproveFailed()
Add the following on PreMarkets.t.sol
and run forge test --match-test test_DoS_whenWithdrawingFunds -vv
Output:
Loss of funds: Makers/Takers will lose their funds as they cannot withdraw.
Manual Review & Foundry
Set the native token address as a parameter when calling CapitalPool.approve
.
If we consider the correct permissioned implementation for the `approve()` function within `CapitalPool.sol`, this would be a critical severity issue, because the withdrawal of funds will be permanently blocked and must be rescued by the admin via the `Rescuable.sol` contract, given it will always revert [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/CapitalPool.sol#L36-L38) when attempting to call a non-existent function selector `approve` within the TokenManager contract. The argument up in the air is since the approval function `approve` was made permisionless, the `if` block within the internal `_transfer()` function will never be invoked if somebody beforehand calls approval for the TokenManager for the required token, so the transfer will infact not revert when a withdrawal is invoked. I will leave open for escalation discussions, but based on my first point, I believe high severity is appropriate.
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.