Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Use of an incorrect parameter in function `TokenManager.sol#_transfer()`

0xhunter

Summary

In the TokenManager.sol#_transfer() function, the transaction may cause a DoS by using the incorrect parameter when approving the token to the CapitalPool contract.

Vulnerability Details

The TokenManager.sol#_transfer() is an internal function used to transfer an ERC20 token.
The root cause of the issue is that when accepting a token to this contract to withdraw assets from the CapitalPool contract in the _transfer() function, the address of the TokenManager contract itself is passed as a parameter, not the token address.

function _transfer(
address _token,
address _from,
address _to,
uint256 _amount,
address _capitalPoolAddr
) internal {
uint256 fromBalanceBef = IERC20(_token).balanceOf(_from);
uint256 toBalanceBef = IERC20(_token).balanceOf(_to);
​
if (
_from == _capitalPoolAddr &&
IERC20(_token).allowance(_from, address(this)) == 0x0
) {
--> ICapitalPool(_capitalPoolAddr).approve(address(this));
}
​
_safe_transfer_from(_token, _from, _to, _amount);
​
uint256 fromBalanceAft = IERC20(_token).balanceOf(_from);
uint256 toBalanceAft = IERC20(_token).balanceOf(_to);
​
if (fromBalanceAft != fromBalanceBef - _amount) {
revert TransferFailed();
}
​
if (toBalanceAft != toBalanceBef + _amount) {
revert TransferFailed();
}
}

However, the CapitalPool.sol#approve() function considers the delivered address as the address of an ERC20 token and calls the approve() function, which is an ERC20 standard function.

function approve(address tokenAddr) external {
address tokenManager = tadleFactory.relatedContracts(
RelatedContractLibraries.TOKEN_MANAGER
);
--> (bool success, ) = tokenAddr.call(
abi.encodeWithSelector(
APPROVE_SELECTOR,
tokenManager,
type(uint256).max
)
);
​
--> if (!success) {
revert ApproveFailed();
}
}

As a result, success returns false and the transaction fails.
In the initial state, the CapitalPool.sol#approve() function is considered to be called only by the token manager, so the transaction will always fail and the user will not be able to withdraw assets from CapitalPool and will be permanently locked.

/**
* @dev Approve token for token manager
--> * @notice only can be called by token manager
* @param tokenAddr address of token
*/

Impact

The transaction will always fail and the user will not be able to withdraw assets from CapitalPool and will be permanently locked.

Tools Used

Manual Review

Recommendations

It is recommended to modify the TokenManager.sol#_transfer() function as follows:

function _transfer(
address _token,
address _from,
address _to,
uint256 _amount,
address _capitalPoolAddr
) internal {
uint256 fromBalanceBef = IERC20(_token).balanceOf(_from);
uint256 toBalanceBef = IERC20(_token).balanceOf(_to);
​
if (
_from == _capitalPoolAddr &&
IERC20(_token).allowance(_from, address(this)) == 0x0
) {
--- ICapitalPool(_capitalPoolAddr).approve(address(this));
+++ ICapitalPool(_capitalPoolAddr).approve(_token);
}
​
SNIP...
}
Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-TokenManager-approve-wrong-address-input

If we consider the correct permissioned implementation for the `approve()` function within `CapitalPool.sol`, this would be a critical severity issue, because the withdrawal of funds will be permanently blocked and must be rescued by the admin via the `Rescuable.sol` contract, given it will always revert [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/CapitalPool.sol#L36-L38) when attempting to call a non-existent function selector `approve` within the TokenManager contract. The argument up in the air is since the approval function `approve` was made permisionless, the `if` block within the internal `_transfer()` function will never be invoked if somebody beforehand calls approval for the TokenManager for the required token, so the transfer will infact not revert when a withdrawal is invoked. I will leave open for escalation discussions, but based on my first point, I believe high severity is appropriate.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.