Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Anyone can approve any token for token manager

youleeyan

Summary

In CapitalPool.sol the function approve() is used for approving tokens for the token manager. In the devtext we can see the following message:

* @notice only can be called by token manager

However, this is not enforced by modifier and is not checked in the implementation of the function. This means that anyone can call the function by passing a token address and approve the tokenManager for the tokn.

PoC

Use the following test case. The test passes, meaning the user approves the token manager for unlimitted wet9 transfers.

function test_approve() public{
vm.startPrank(user);
capitalPool.approve(address(weth9));
vm.stopPrank();
}

Tools Used

Manual review

Recommendations

Add a check if msg.sender is token manager and if not revert.

Updates

Lead Judging Commences

0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-CapitalPool-approve-missing-access-control

This is at most low severity, even though giving max approvals shouldn't be permisionless, the respective tokenManager address is retrieved from the TadleFactory contract whereby the trusted guardian role is responsible for deploying such contracts as seen [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/factory/TadleFactory.sol#L68). Since the user still has to go through the PreMarkets/DeliveryPlace contracts to perform market actions, this max approval cannot be exploited.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!