Tadle

Summary

Missing Access Controls in CapitalPool::approve

Vulnerability Details

CapitalPool::approve shown in the code snippet below does not include any access control checks, meaning that anyone could call this function and approve tokens for the tokenManager:

https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/CapitalPool.sol#L24-L39

However, the comment above the function indicates that only a token manager should be allowed to call this function:

https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/CapitalPool.sol#L21

Impact

1. Unauthorized Approval: Since anyone can call the approve function, any external address could grant unlimited token allowances to the tokenManager without the token owner's consent. This could lead to unauthorized spending of tokens on behalf of users or contracts. Malicious actors could drain tokens from the contract by using the tokenManager to transfer these tokens to themselves or other accounts.

2. **Loss of Funds: **If the tokenManager is compromised or if its behavior is controlled by an attacker, they could exploit the lack of access control to siphon off large amounts of tokens. Users and the contract itself could lose significant funds, which can erode trust and cause financial damage to the stakeholders involved.

3. Potential for Denial of Service (DoS): Malicious users could repeatedly call the function to set or reset allowances, potentially disrupting the normal operations of the tokenManager. This could cause interruptions in services that rely on the tokenManager, leading to operational inefficiencies.

Tools Used

Manual Review

Recommendations

• **Use an onlyTokenManager Modifier: **Define a modifier that restricts access:

• Check Caller Address: Directly within the function, the code could check if the caller is the token manager: