Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect Approval in _transfer Function Leading to Failed Withdrawals

Tomas0707

Summary

The _transfer function within the TokenManager.sol contract of the Tadle protocol contains a critical error where the approve function of the CapitalPool contract is called with an incorrect parameter. This leads to a failure in approving the transfer of tokens from the CapitalPool to users, ultimately preventing users from withdrawing their tokens.

Vulnerability Details

The _transfer function is designed to facilitate the transfer of tokens between accounts, including transfers from the CapitalPool contract. However, when the function attempts to approve the TokenManager contract to spend tokens on behalf of the CapitalPool, it mistakenly passes the address of the TokenManager itself instead of the token's address.

if (
_from == _capitalPoolAddr &&
IERC20(_token).allowance(_from, address(this)) == 0x0
) {
ICapitalPool(_capitalPoolAddr).approve(address(this));
}

This incorrect call fails to properly approve the token transfer, causing the withdrawal process to fail.

Impact

This error effectively locks users' tokens within the CapitalPool, as they are unable to withdraw their balances due to the lack of proper approval. This issue can significantly affect user trust and disrupt the operation of the platform.

Proof of Concept

This is the test code of the vulnerability.

function test_ask_offer_turbo_eth() public {
vm.prank(user);
preMarktes.createOffer{value: 0.012 * 1e18}(
CreateOfferParams(
marketPlace,
address(weth9),
1000,
0.01 * 1e18,
12000,
300,
OfferType.Ask,
OfferSettleType.Turbo
)
);
​
address offerAddr = GenerateAddress.generateOfferAddress(0);
vm.prank(user2);
preMarktes.createTaker{value: 0.005175 * 1e18}(offerAddr, 500);
​
vm.startPrank(user);
vm.expectRevert();
tokenManager.withdraw(address(weth9), TokenBalanceType.SalesRevenue);
​
capitalPool.approve(address(weth9));
tokenManager.withdraw(address(weth9), TokenBalanceType.TaxIncome);
tokenManager.withdraw(address(weth9), TokenBalanceType.SalesRevenue);
vm.stopPrank();
}

The result is like this.

│ │ ├─ [9999] UpgradeableProxy::approve(UpgradeableProxy: [0x6891e60906DEBeA401F670D74d01D117a3bEAD39])
│ │ │ ├─ [4983] CapitalPool::approve(UpgradeableProxy: [0x6891e60906DEBeA401F670D74d01D117a3bEAD39]) [delegatecall]
│ │ │ │ ├─ [534] TadleFactory::relatedContracts(5) [staticcall]
│ │ │ │ │ └─ ← [Return] UpgradeableProxy: [0x6891e60906DEBeA401F670D74d01D117a3bEAD39]
│ │ │ │ ├─ [708] UpgradeableProxy::approve(UpgradeableProxy: [0x6891e60906DEBeA401F670D74d01D117a3bEAD39], 115792089237316195423570985008687907853269984665640564039457584007913129639935 [1.157e77])
│ │ │ │ │ ├─ [192] TokenManager::approve(UpgradeableProxy: [0x6891e60906DEBeA401F670D74d01D117a3bEAD39], 115792089237316195423570985008687907853269984665640564039457584007913129639935 [1.157e77]) [delegatecall]
│ │ │ │ │ │ └─ ← [Revert] EvmError: Revert
│ │ │ │ │ └─ ← [Revert] EvmError: Revert
│ │ │ │ └─ ← [Revert] ApproveFailed()
│ │ │ └─ ← [Revert] ApproveFailed()
│ │ └─ ← [Revert] ApproveFailed()
│ └─ ← [Revert] ApproveFailed()
├─ [33851] UpgradeableProxy::approve(WETH9: [0x5615dEB798BB3E4dFa0139dFa1b3D433Cc23b72f])
│ ├─ [28839] CapitalPool::approve(WETH9: [0x5615dEB798BB3E4dFa0139dFa1b3D433Cc23b72f]) [delegatecall]

As you can see, withdraw function call lis reverted in approve function call. This call is finished successfully after direct call of capitalPool.approve.

Tools Used

Manual code review

Recommendations

To resolve this issue, the approve function should be correctly called with the token address.

if (
_from == _capitalPoolAddr &&
IERC20(_token).allowance(_from, address(this)) == 0x0
) {
ICapitalPool(_capitalPoolAddr).approve(_token);
}
Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-TokenManager-approve-wrong-address-input

If we consider the correct permissioned implementation for the `approve()` function within `CapitalPool.sol`, this would be a critical severity issue, because the withdrawal of funds will be permanently blocked and must be rescued by the admin via the `Rescuable.sol` contract, given it will always revert [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/CapitalPool.sol#L36-L38) when attempting to call a non-existent function selector `approve` within the TokenManager contract. The argument up in the air is since the approval function `approve` was made permisionless, the `if` block within the internal `_transfer()` function will never be invoked if somebody beforehand calls approval for the TokenManager for the required token, so the transfer will infact not revert when a withdrawal is invoked. I will leave open for escalation discussions, but based on my first point, I believe high severity is appropriate.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.