Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Inconsistent access control in function withdraw

kwakudr

Summary

The function is intended to be restricted to the owner, as indicated by the comment, but there is no onlyOwner modifier or equivalent access control to enforce this restriction.

Vulnerability Details

/**
* @notice Withdraw
* @dev Caller must be owner
* @param _tokenAddress Token address
* @param _tokenBalanceType Token balance type
*/
function withdraw(
address _tokenAddress,
TokenBalanceType _tokenBalanceType
) external whenNotPaused {
uint256 claimAbleAmount = userTokenBalanceMap[_msgSender()][
_tokenAddress
][_tokenBalanceType];
​
​
if (claimAbleAmount == 0) {
return;
}

The comment states "Caller must be owner", but the function is marked as external without any onlyOwner modifier.

Impact

This allows any user to call the function, which contradicts the comment.

Tools Used

Manual Review

Recommendations

Add an onlyOwner modifier to ensure only the contract owner can call this function.

Updates

Lead Judging Commences

0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

[invalid] finding-TokenManager-withdraw-lack-access-control

Invalid, withdrawals are gated to caller context `msg.sender`, not anybody. This acts as the access control and hence "owner", to withdraw collateral/points tokens after finalization of market actions.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!