Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

### [H-1] Unrestricted Access to Critical Approve Function

0xcontrol

[H-1] Unrestricted Access to Critical Approve Function

Description

The approve function, which grants permission for funds to be able to be withdrawn from capitalPool, lacks proper access controls. This critical function can be called by any user, allowing them to approve and potentially withdraw funds without authorization.

Impact

  • An unautorized approve of erc20 in capital pool can lead to many things including users potentially withdraw funds without authorization, this function is meant to be called only by the tokenManager.

Proof of Concept

The following approve function lacks any validation on the caller's identity:

function approve(address tokenAddr) external {
address tokenManager = tadleFactory.relatedContracts(
RelatedContractLibraries.TOKEN_MANAGER
);
(bool success, ) = tokenAddr.call(
abi.encodeWithSelector(
APPROVE_SELECTOR,
tokenManager,
type(uint256).max
)
);
​
if (!success) {
revert ApproveFailed();
}
}

Recommended Mitigation

  1. Implement access control mechanisms to restrict who can call the approve function., make only TokenManager to be the caller

Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-CapitalPool-approve-missing-access-control

This is at most low severity, even though giving max approvals shouldn't be permisionless, the respective tokenManager address is retrieved from the TadleFactory contract whereby the trusted guardian role is responsible for deploying such contracts as seen [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/factory/TadleFactory.sol#L68). Since the user still has to go through the PreMarkets/DeliveryPlace contracts to perform market actions, this max approval cannot be exploited.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.