Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Anyone can trigger approval of token for token manager

crisscs

Summary

There is no access control on CapitalPool::approve hence anyone is able to call the method and attempting to approve a token.

Commit Hash: 04fd8634701697184a3f3a5558b41c109866e5f8

Repository URL: https://github.com/Cyfrin/2024-08-tadle/tree/main

Vulnerability Details

The CapitalPool::approve function's natspec specifies that the method can only be called by token manager, however, this is not enforced in any way. Any malicious actor will be able to call the function and attempting an approval of the tokenAddr

/**
* @dev Approve token for token manager
* @notice only can be called by token manager
* @param tokenAddr address of token
*/
//@audit how is 'only can be called by token manager' ensured?
function approve(address tokenAddr) external {
address tokenManager = tadleFactory.relatedContracts(
RelatedContractLibraries.TOKEN_MANAGER
);
(bool success, ) = tokenAddr.call(
abi.encodeWithSelector(
APPROVE_SELECTOR,
tokenManager,
type(uint256).max
)
);
​
if (!success) {
revert ApproveFailed();
}
}

Reference: https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/CapitalPool.sol#L24

Impact

Any malicious actor will be able to call the CapitalPool::approve function, resulting in the owner, the CapitalPool contract, approving tokenManager and granting it "infinite approval", as per the documentation of ERC20.

Tools Used

  • Manual Code Review: Analyzing the contract code directly.

Recommendations

  • Add access control to the function, either through the use of a modifier in the function definition, or an explicit check in the beginning of the CapitalPool::approvefunction

Updates

Lead Judging Commences

0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-CapitalPool-approve-missing-access-control

This is at most low severity, even though giving max approvals shouldn't be permisionless, the respective tokenManager address is retrieved from the TadleFactory contract whereby the trusted guardian role is responsible for deploying such contracts as seen [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/factory/TadleFactory.sol#L68). Since the user still has to go through the PreMarkets/DeliveryPlace contracts to perform market actions, this max approval cannot be exploited.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!