Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Missing access control on approve function

kwakudr

Summary

The approve function lacks proper access control mechanisms. Despite the comment indicating that it should only be callable by the token manager, there's no actual check in place to enforce this restriction.

Vulnerability Details

function approve(address tokenAddr) external {
address tokenManager = tadleFactory.relatedContracts(
RelatedContractLibraries.TOKEN_MANAGER
);
(bool success, ) = tokenAddr.call(
abi.encodeWithSelector(
APPROVE_SELECTOR,
tokenManager,
type(uint256).max
)
);
​
​
if (!success) {
revert ApproveFailed();
}
}

Any external actor can call this function, potentially leading to unauthorized approvals. This could result in the capital pool granting spending rights to unintended parties.

Impact

Any external actor can call this function, potentially leading to unauthorized approvals. This could result in the capital pool granting spending rights to unintended parties.

Tools Used

Manual Review

Recommendations

Implement a modifier or require statement to check the caller's identity

Updates

Lead Judging Commences

0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-CapitalPool-approve-missing-access-control

This is at most low severity, even though giving max approvals shouldn't be permisionless, the respective tokenManager address is retrieved from the TadleFactory contract whereby the trusted guardian role is responsible for deploying such contracts as seen [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/factory/TadleFactory.sol#L68). Since the user still has to go through the PreMarkets/DeliveryPlace contracts to perform market actions, this max approval cannot be exploited.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!