Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Lack of Access Control in `CapitalPool::approve` Function

0xdarko

Summary

The CapitalPool::approve function lacks proper access control, allowing any address to call it instead of restricting access to the TokenManager contract only.

Vulnerability Details

The approve function in the CapitalPool contract does not implement any access control checks. This allows any external actor to call the function and potentially approve spending of the CapitalPool's tokens.

function approve(address tokenAddr) external {
address tokenManager = tadleFactory.relatedContracts(
RelatedContractLibraries.TOKEN_MANAGER
);
// Missing access control check
// ... rest of the function
}

Impact

  1. Unauthorized approvals of CapitalPool's tokens.

  2. Potential loss of funds if combined with other vulnerabilities.

  3. Violation of the principle of least privilege.

Tools Used

Foundry

Recommendations

Implement access control to restrict the approve function to the TokenManager only:

+ error NotTokenManager();
​
function approve(address tokenAddr) external {
address tokenManager = tadleFactory.relatedContracts(
RelatedContractLibraries.TOKEN_MANAGER
);
+ if(msg.sender != tokenManager) {
+ revert NotTokenManager();
+ }
// ... rest of the function
}
Updates

Lead Judging Commences

0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-CapitalPool-approve-missing-access-control

This is at most low severity, even though giving max approvals shouldn't be permisionless, the respective tokenManager address is retrieved from the TadleFactory contract whereby the trusted guardian role is responsible for deploying such contracts as seen [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/factory/TadleFactory.sol#L68). Since the user still has to go through the PreMarkets/DeliveryPlace contracts to perform market actions, this max approval cannot be exploited.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!