Tadle

Github

• https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/CapitalPool.sol#L24

Summary

The approve function within the CapitalPool contract lacks an authorization check, allowing any address to call the function. This vulnerability could lead to unauthorized token approvals, posing a significant security risk to the contract and its associated assets.

Vulnerability Details

The approve function is designed to approve an unlimited amount of a specified token for the tokenManager. However, the function does not include a check to ensure that only the designated tokenManager can execute it. Specifically, there is no verification that msg.sender is indeed the tokenManager.

This omission allows any address to call the approve function, potentially leading to unauthorized approvals. Since the function uses a low-level call to the token contract, any arbitrary address could trigger the approval of tokens, which could then be transferred or manipulated in unintended ways.

See the following code:

Impact

The absence of an authorization check in the approve function exposes the contract to unauthorized access. This vulnerability can be exploited by any address, allowing it to approve an unlimited amount of tokens for the tokenManager. An attacker could approve tokens on behalf of the contract and then manipulate the tokenManager to transfer them out. Tokens could be drained from the contract, leading to significant financial losses. The security and integrity of the contract could be severely undermined, compromising trust among users and stakeholders.

Tools Used

Manual Review

Recommendations

Add a require statement to verify that only the tokenManager can call the approve function.