Submission Details
Severity:
Lack of access control allow anyone to call `withdraw` function
## Summary
The withdraw function does not include the `onlyOwner` modifier or any other access control mechanism, allowing anyone to call the function.
## Vulnerability Details
- [TokenManager.sol#L137](#https://github.com/Cyfrin/2024-08-tadle/blob/main/src/core/TokenManager.sol#L137)
```solidity
File: /home/dharma/work/2024-08-tadle/src/core/TokenManager.sol
137: function withdraw(
address _tokenAddress,
TokenBalanceType _tokenBalanceType //@audit missing modifier onlyOwner
) external whenNotPaused {
uint256 claimAbleAmount = userTokenBalanceMap[_msgSender()][
_tokenAddress
][_tokenBalanceType];
if (claimAbleAmount == 0) {
return;
}
address capitalPoolAddr = tadleFactory.relatedContracts(
RelatedContractLibraries.CAPITAL_POOL
);
if (_tokenAddress == wrappedNativeToken) {
* @dev token is native token
* @dev transfer from capital pool to msg sender
* @dev withdraw native token to token manager contract
* @dev transfer native token to msg sender
*/
_transfer(
wrappedNativeToken,
capitalPoolAddr,
address(this),
claimAbleAmount,
capitalPoolAddr
);
IWrappedNativeToken(wrappedNativeToken).withdraw(claimAbleAmount);
payable(msg.sender).transfer(claimAbleAmount);
} else {
/**
* @dev token is ERC20 token
* @dev transfer from capital pool to msg sender
*/
_safe_transfer_from(
_tokenAddress,
capitalPoolAddr,
_msgSender(),
claimAbleAmount
);
}
emit Withdraw(
_msgSender(),
_tokenAddress,
_tokenBalanceType,
claimAbleAmount
);
}
```
## Impact
This can lead to unauthorized users being able to withdraw funds, which could result in a complete loss of the contract’s funds if exploited.
## Recommendations
Change to:
```solidity
function withdraw(
address _tokenAddress,
TokenBalanceType _tokenBalanceType
) external onlyOwner whenNotPaused {
// ...
}
```
Updates
Lead Judging Commences
0xnevi about 1 year ago
Submission Judgement Published Reason: Incorrect statement
Assigned finding tags:
[invalid] finding-TokenManager-withdraw-lack-access-control
Invalid, withdrawals are gated to caller context `msg.sender`, not anybody. This acts as the access control and hence "owner", to withdraw collateral/points tokens after finalization of market actions.
Prize pool breakdown
Total prize
27,750 USDC
nSLOC
1,22923
USDC / LOC
25,000 USDC
2,750 USDC
2,250 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.