Tadle

Summary

The approve function in the CapitalPool contract can be called by anyone, not just the intended TokenManager contract. This unrestricted access could lead to core functionality failures and potential malicious exploitation.

Vulnerability Details

The root cause of the vulnerability is that the approve function lacks a proper access control mechanism, allowing any external account to call it.

• Found in src/core/CapitalPool.sol at Line 24

@>: dev noted that "only can be called by token manager" but approve can actually be called by anyone

Let us walk through the issue with the following scenario:

1. Alice, who is a legitimate user of the TokenManager, triggers a token transfer that requires approval from the CapitalPool.

2. Bob, a malicious actor, identifies this and frontruns Alice's transaction by calling the approve function with a malicious tokenAddr.

3. As a result, Bob's malicious contract gets approved to transfer tokens from the CapitalPool, leading to potential undefined behavior, or worse, he can DOS a transfer of tokens like USDT, which has strict approval rules requiring existing allowances to be zero before setting a new allowance.

USDT's implementation:

@>: USDT requires user's allowedbalance to be 0 before proceeds to update the allowance. By frontruning the permissionless CapitalPool:approve, it's posible for BOB to DOS Alice's transaction.

Impact

This vulnerability is significant as aside from breaking Dev's intended core functionality, malicious actor can also DOS a token transfer process, especially with tokens like USDT that have specific allowance requirements.

Tools Used

Manual Review

Recommendations

Add a check to ensure that only the TokenManager contract can call the approve function: