Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Unauthorized Access in `CapitalPool::approve` Allows Unrestricted Approvals

pina

Summary

The CapitalPool::approve function can be called by any user, despite documentation specifying that it should only be callable by the token manager.

Vulnerability Details

As shown in the code below, the approve function does not ensure that only the token manager can call it. This lack of access control allows any user to invoke the function.

function approve(address tokenAddr) external { // <== HERE
address tokenManager = tadleFactory.relatedContracts(
RelatedContractLibraries.TOKEN_MANAGER
);
(bool success, ) = tokenAddr.call(
abi.encodeWithSelector(
APPROVE_SELECTOR,
tokenManager,
type(uint256).max
)
);
​
if (!success) {
revert ApproveFailed();
}
}

PoC

​
function test_any_one_call_approve() public {
vm.startPrank(user);
capitalPool.approve(address(mockUSDCToken));
uint256 allowance = mockUSDCToken.allowance(address(user),address(tokenManager));
assertEq(allowance,type(uint256).max);
}

Impact

A user could mistakenly or maliciously approve a contract with maximum allowance, leading to potential loss of funds or unauthorized contract interaction.

Tools Used

  • Manual Review

  • Foundry

Recommendations

Change the function visibility:

- function approve(address tokenAddr) external {
+ function approve(address tokenAddr) internal {
Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-CapitalPool-approve-missing-access-control

This is at most low severity, even though giving max approvals shouldn't be permisionless, the respective tokenManager address is retrieved from the TadleFactory contract whereby the trusted guardian role is responsible for deploying such contracts as seen [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/factory/TadleFactory.sol#L68). Since the user still has to go through the PreMarkets/DeliveryPlace contracts to perform market actions, this max approval cannot be exploited.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.