Tadle

Summary

The withdrawal amount is not deducted from the balance during a withdrawal in the TokenManager.withdraw() function. This oversight allows anyone to call the function multiple times, draining all funds from the protocol.

Vulnerability Details

The issue is straightforward: in the TokenManager.withdraw() function, there is no deduction from the user’s balance when a withdrawal is made. The userTokenBalanceMap mapping is not updated.

For an attacker to exploit this he needs to have a positive balance in userTokenBalanceMap to drain tokens from the CapitalPool contract, to make it happen he would need to:

1. Create an Ask order with some collateral value, for example 1000 USDC.

2. Instantly close that order to have the refund amount credited via the TokenManager.addTokenBalance() function.

3. In case of missing approval from the CapitalPool contract to the TokenManager contract, they can call CapitalPool.approve() for the necessary token, as CapitalPool.approve() lacks access control.

4. Call the withdraw() function multiple times to drain all funds of the specific token.

Impact

All funds can be stolen from the protocol.

Tools Used

Manual review.

Recommendations

Update userTokenBalanceMap to reflect the withdrawn amount of tokens.