Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Traders can drain the capitalPool via withdraw()

jennifersun

Summary

When traders withdraw funds via withdraw(), the claimable amount userTokenBalanceMap[_msgSender()][_tokenAddress][_tokenBalanceType] is not reset to 0. This cause that the traders can withdraw tokens from the capitalPool repeatedly.

Vulnerability Details

In TokenManager, the traders can withdraw tokens from the capitalPool via withdraw().
We use the variable userTokenBalanceMap to record the claimable amount. The problem is that after the trader withdraw the claimAbleAmount, the variable is not reset to 0. Then the traders can withdraw the funds repeatedly to drain the capitalPool.

function withdraw(
address _tokenAddress,
TokenBalanceType _tokenBalanceType
) external whenNotPaused {
uint256 claimAbleAmount = userTokenBalanceMap[_msgSender()][
_tokenAddress
][_tokenBalanceType];
​
if (claimAbleAmount == 0) {
return;
}
// get capital pool address.
address capitalPoolAddr = tadleFactory.relatedContracts(
RelatedContractLibraries.CAPITAL_POOL
);
​
if (_tokenAddress == wrappedNativeToken) {
_transfer(
wrappedNativeToken,
capitalPoolAddr,
address(this),
claimAbleAmount,
capitalPoolAddr
);
// Unwrap WETH to Ether.
IWrappedNativeToken(wrappedNativeToken).withdraw(claimAbleAmount);
payable(msg.sender).transfer(claimAbleAmount);
} else {
_safe_transfer_from(
_tokenAddress,
capitalPoolAddr,
_msgSender(),
claimAbleAmount
);
}
}

Impact

The capitalPool will be drained.

Tools Used

Manual

Recommendations

Reset the userTokenBalanceMap[_msgSender()][_tokenAddress][_tokenBalanceType] when the trader withdraw tokens.

Updates

Lead Judging Commences

0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-TokenManager-withdraw-userTokenBalanceMap-not-reset

Valid critical severity finding, the lack of clearance of the `userTokenBalanceMap` mapping allows complete draining of the CapitalPool contract. Note: This would require the approval issues highlighted in other issues to be fixed first (i.e. wrong approval address within `_transfer` and lack of approvals within `_safe_transfer_from` during ERC20 withdrawals)

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!