Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

DoS on withdraw due to wrong parameter on approve call

holydevoti0n

Summary

When calling the withdrawwith the native token, users can't withdraw due to the wrong parameter being set here.

https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/TokenManager.sol#L247

function _transfer(
address _token,
address _from,
address _to,
uint256 _amount,
address _capitalPoolAddr
) internal {
...
if (
_from == _capitalPoolAddr &&
IERC20(_token).allowance(_from, address(this)) == 0x0
) {
@> ICapitalPool(_capitalPoolAddr).approve(address(this));
}
...
}

Notice that the parameter being passed to approveis the address(this). But this parameter is expected to be the token address, not the receiver:

https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/CapitalPool.sol#L28

@> function approve(address tokenAddr) external {
address tokenManager = tadleFactory.relatedContracts(
RelatedContractLibraries.TOKEN_MANAGER
);
@> (bool success, ) = tokenAddr.call(
abi.encodeWithSelector(
APPROVE_SELECTOR,
tokenManager,
type(uint256).max
)
);
​
​
if (!success) {
@> revert ApproveFailed();
}
}

Due to the TokenManagerbeing passed instead of the native token address, the call will revert with ApproveFailed()

PoC

Add the following on PreMarkets.t.soland run forge test --match-test test_DoS_whenWithdrawingFunds -vv

// import {ICapitalPool} from "../src/interfaces/ICapitalPool.sol";
function test_DoS_whenWithdrawingFunds() public {
// pre condition - create/close a market offer
_createOfferForUser(user1);
vm.startPrank(user1);
address stock1Addr = GenerateAddress.generateStockAddress(0);
address offer1Addr = GenerateAddress.generateOfferAddress(0);
preMarktes.closeOffer(stock1Addr, offer1Addr);
​
// act - when try to withdraw funds will revert with ApprovedFailed
vm.expectRevert(ICapitalPool.ApproveFailed.selector);
tokenManager.withdraw(address(weth9), TokenBalanceType.MakerRefund);
vm.stopPrank();
}
​
function _createOfferForUser(address _user) internal {
vm.startPrank(_user);
​
deal(_user, 100000000 * 10 ** 18);
​
preMarktes.createOffer{value: 100e18}(
CreateOfferParams(
marketPlace,
address(weth9),
1000,
1e18,
12000,
300,
OfferType.Ask,
OfferSettleType.Protected
)
);
​
vm.stopPrank();
}

Output:

Ran 1 test for test/PreMarkets.t.sol:PreMarketsTest
[PASS] test_DoS_whenWithdrawingFunds() (gas: 623109)
@> Suite result: ok. 1 passed; 0 failed; 0 skipped; finished in 10.17ms (1.50ms CPU time)

Impact

Loss of funds: Makers/Takers will lose their funds as they cannot withdraw.

Tools Used

Manual Review & Foundry

Recommendations

Set the native token address as a parameter when calling CapitalPool.approve.

if (
_from == _capitalPoolAddr &&
IERC20(_token).allowance(_from, address(this)) == 0x0
) {
- ICapitalPool(_capitalPoolAddr).approve(address(this));
+ ICapitalPool(_capitalPoolAddr).approve(_token);
}
Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-TokenManager-approve-wrong-address-input

If we consider the correct permissioned implementation for the `approve()` function within `CapitalPool.sol`, this would be a critical severity issue, because the withdrawal of funds will be permanently blocked and must be rescued by the admin via the `Rescuable.sol` contract, given it will always revert [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/CapitalPool.sol#L36-L38) when attempting to call a non-existent function selector `approve` within the TokenManager contract. The argument up in the air is since the approval function `approve` was made permisionless, the `if` block within the internal `_transfer()` function will never be invoked if somebody beforehand calls approval for the TokenManager for the required token, so the transfer will infact not revert when a withdrawal is invoked. I will leave open for escalation discussions, but based on my first point, I believe high severity is appropriate.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.