Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

error updates in withdraw function

kwakudr

Summary

The core problem is that after processing a withdrawal, the function doesn't update the user's balance in the userTokenBalanceMap.

Vulnerability Details

/**
* @notice Withdraw
* @dev Caller must be owner
* @param _tokenAddress Token address
* @param _tokenBalanceType Token balance type
*/
function withdraw(
address _tokenAddress,
TokenBalanceType _tokenBalanceType
) external whenNotPaused {
uint256 claimAbleAmount = userTokenBalanceMap[_msgSender()][
_tokenAddress
][_tokenBalanceType];
​
​
if (claimAbleAmount == 0) {
return;
}

Impact

A user could potentially withdraw the same amount multiple times, as their recorded balance never decreases. This could lead to a situation where more funds are withdrawn than should be possible, potentially draining the contract or capital pool.

Tools Used

Manual Review

Recommendations

update the userTokenBalanceMapafter a successful withdraw

Updates

Lead Judging Commences

0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-TokenManager-withdraw-userTokenBalanceMap-not-reset

Valid critical severity finding, the lack of clearance of the `userTokenBalanceMap` mapping allows complete draining of the CapitalPool contract. Note: This would require the approval issues highlighted in other issues to be fixed first (i.e. wrong approval address within `_transfer` and lack of approvals within `_safe_transfer_from` during ERC20 withdrawals)

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!