Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

[H-1] `userTokenBalanceMap` is never updated while withdrawing, causing protocol to be drained.

karanel

Relevant Links

https://github.com/Cyfrin/2024-08-tadle/blob/main/src/core/TokenManager.sol#L137-L189

Summary

userTokenBalanceMap is never updated while withdrawing, causing protocol to be drained.

Vulnerability Details

When a user has gained any funds through any of the multiple ways (see PreMarket.sol and DeliveryPlace.sol), their userTokenBalanceMap is updated. When a user has any balance, they can withdraw the gained amount by calling TokenManager::withdraw function.

However, userTokenBalanceMap is never updated on calling TokenManager::withdraw, allowing a malicious user to be able to drain the particular ERC20 token from the CapitalPool contract by withdrawing multiple times.

Impact

Likelihood: High - userTokenBalanceMap is never updated
Impact: High - Theft of funds

Overall severity is high.

Tools Used

Manual Review

Recommendations

Update userTokenBalanceMap when tokens are transferred.

function withdraw(
address _tokenAddress,
TokenBalanceType _tokenBalanceType
) external whenNotPaused {
uint256 claimAbleAmount = userTokenBalanceMap[_msgSender()][
_tokenAddress
][_tokenBalanceType];
​
if (claimAbleAmount == 0) {
return;
}
+ userTokenBalanceMap[_msgSender()][_tokenAddress][_tokenBalanceType] = 0;
​
address capitalPoolAddr = tadleFactory.relatedContracts(
RelatedContractLibraries.CAPITAL_POOL
);
​
Updates

Lead Judging Commences

0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-TokenManager-withdraw-userTokenBalanceMap-not-reset

Valid critical severity finding, the lack of clearance of the `userTokenBalanceMap` mapping allows complete draining of the CapitalPool contract. Note: This would require the approval issues highlighted in other issues to be fixed first (i.e. wrong approval address within `_transfer` and lack of approvals within `_safe_transfer_from` during ERC20 withdrawals)

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!