Cyfrin CodeHawks | #30 - Lack of Access Control in `approve` Function Allows Unauthorized Token Approvals

Summary

The approve function in CapitalPool.sol lacks access control, allowing any user to call it and approve tokens. This contradicts the function's comment, which states that it should only be callable by the token manager. This vulnerability can lead to unauthorized approvals and potential misuse of tokens.

Vulnerability Details

Location: CapitalPool.sol::approve

Description:

The approve function is intended to be called only by the token manager to approve tokens. However, the function does not enforce any access control, enabling any user to call it and approve tokens for the token manager.

Proof of Concept

/**
 * @dev Approve token for token manager
 * @notice only can be called by token manager
 * @param tokenAddr address of token
 */
// @audit anyone can call approve
function approve(address tokenAddr) external {
    address tokenManager = tadleFactory.relatedContracts(RelatedContractLibraries.TOKEN_MANAGER);
    (bool success, ) = tokenAddr.call(
        abi.encodeWithSelector(
            APPROVE_SELECTOR,
            tokenManager,
            type(uint256).max
        )
    );

    if (!success) {
        revert ApproveFailed();
    }
}

Root Cause:

The function lacks access control mechanisms to restrict its execution to the token manager. As a result, any user can call this function and approve tokens, potentially leading to unauthorized token transfers and other malicious activities.

Impact

This vulnerability allows any user to call the approve function and approve tokens for the token manager. This can lead to unauthorized token approvals, resulting in potential loss or misuse of tokens.

Tools Used

Manual code review

Recommendations

Implement Access Control: Add access control to the approve function to ensure that only the token manager can call it.

Tadle

Lack of Access Control in `approve` Function Allows Unauthorized Token Approvals

Summary

Vulnerability Details

Description:

Proof of Concept

Root Cause:

Impact

Tools Used

Recommendations

Community Judging Commences

Lead Judging Commences

finding-CapitalPool-approve-missing-access-control

Prize pool breakdown

Live

Community Judging

Judging

Appeals

Appeals Review

Rewards Distribution

FAQs