Tadle
Tadle
DeFi
30,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

approve()::CapitalPool.sol is callable by anyone

0xziin

Summary

approve()::CapitalPool.sol is callable by anyone, but if we refer to the comment of the function, it "can only be called by token manager".

Vulnerability Details

approve()::CapitalPool.sol is callable by anyone, even non token manager contract.

If we refer to the comment of the function, it should only be able to be called by token manager but there is in fact no restriction.

@notice only can be called by token manager

Below is approve()::CapitalPool.sol :

/**
* @dev Approve token for token manager
* @notice only can be called by token manager
* @param tokenAddr address of token
*/
function approve(address tokenAddr) external {
address tokenManager = tadleFactory.relatedContracts(
RelatedContractLibraries.TOKEN_MANAGER
);
(bool success, ) = tokenAddr.call(
abi.encodeWithSelector(
APPROVE_SELECTOR,
tokenManager,
type(uint256).max
)
);
​
if (!success) {
revert ApproveFailed();
}
}

We can see that there is no check to only authorize token manager.
No modifier nor require(msg.sender == tokenManager, "Only token manager can call this function").

Impact

The function doesn't respect the rules defined by the devs, specified in comment. Since this function doesn't take in argument the amount of token to approve, it shouldn't be a problem concerning security, this is why this submission has been defined as Low.

Tools Used

Github, VisualCode.

Recommendations

If you still want to respect the directives in comment, then add :

require(msg.sender == tokenManager, "Only token manager can call this function");

in approve()::CapitalPool.sol.

Or just change the directives in comment and accept the fact that anyone can call this function.

Updates

Lead Judging Commences

0xnevi Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-CapitalPool-approve-missing-access-control

This is at most low severity, even though giving max approvals shouldn't be permisionless, the respective tokenManager address is retrieved from the TadleFactory contract whereby the trusted guardian role is responsible for deploying such contracts as seen [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/factory/TadleFactory.sol#L68). Since the user still has to go through the PreMarkets/DeliveryPlace contracts to perform market actions, this max approval cannot be exploited.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.