Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

`userTokenBalanceMap` doesn't update when an user withdraw tokens from capitalPool

0xaraj

Summary

userTokenBalanceMap doesn't update when an user withdraws tokens from capitalPool

Vulnerability Details

A user can withdraw his tokens from capitalPool using tokenManager:withdraw(), but the problem is it doesn't update the userTokenBalanceMap(which stores the withdrawable balance of the user) upon withdrawl

function withdraw(address _tokenAddress, TokenBalanceType _tokenBalanceType) external whenNotPaused {
@> uint256 claimAbleAmount = userTokenBalanceMap[_msgSender()][_tokenAddress][_tokenBalanceType];
if (claimAbleAmount == 0) {
return;
}
​
address capitalPoolAddr = tadleFactory.relatedContracts(RelatedContractLibraries.CAPITAL_POOL);
​
if (_tokenAddress == wrappedNativeToken) {
_transfer(wrappedNativeToken, capitalPoolAddr, address(this), claimAbleAmount, capitalPoolAddr);
IWrappedNativeToken(wrappedNativeToken).withdraw(claimAbleAmount);
} else {
_safe_transfer_from(_tokenAddress, capitalPoolAddr, _msgSender(), claimAbleAmount);
}
}

Impact

Malicious user can withdraw multiple times, completely draining the capitalPool

Tools Used

Manual Review

Recommendations

Reduce the userTokenBalanceMap to 0

+ userTokenBalanceMap[_msgSender()][_tokenAddress][_tokenBalanceType] = 0;
Updates

Lead Judging Commences

0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-TokenManager-withdraw-userTokenBalanceMap-not-reset

Valid critical severity finding, the lack of clearance of the `userTokenBalanceMap` mapping allows complete draining of the CapitalPool contract. Note: This would require the approval issues highlighted in other issues to be fixed first (i.e. wrong approval address within `_transfer` and lack of approvals within `_safe_transfer_from` during ERC20 withdrawals)

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!