Tadle

Summary

The CapitalPool::approve function is intended to be called only by the tokenManager, as stated in the documentation. However, there is no access control implemented in the function, allowing anyone to call it. This can lead to arbitrary external calls, which may result in unintended or malicious behavior.

Vulnerability Details

The CapitalPool::approve function is designed to grant the tokenManager maximum allowance for a specified token:

According to the comment, this function should only be callable by the tokenManager. However, the function lacks any access control mechanism to enforce this restriction. As a result, any external address can call the approve function, triggering an arbitrary external call to any specified address.

This is not only inconsistent with the intended design but also poses potential significant security risks. An attacker could potentially exploit this to initiate external calls that could result in unintended behavior, especially when the contract is being used to store funds.

The POC is shown below:

In this example, user1 is able to call the approve function and initiate an external call, which is not the intended behavior.

Impact

This vulnerability allows anyone to execute arbitrary external calls through the CapitalPool::approve function. Though the call is being limited to approve, this could still pose potential risks.

Tools Used

Manual, Foundry

Recommendations

Add access control to the approve function to ensure that only the tokenManager can call it.