Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

[High] TokenManager.sol::_transfer() calls the CapitalPool.sol::approve() with wrong parameters, resulting in users not being able to withdraw ETH.

wickie

Description

The TokenManager.sol::_transfer() has the following check:

​
if (
_from == _capitalPoolAddr &&
IERC20(_token).allowance(_from, address(this)) == 0x0
)

CapitalPool.sol::approve() takes in address tokenAddr as a parameters then calls the approve function of tokenAddr using a function selector. When a user calls TokenManger.sol::withdraw() to withdraw ETH, the TokenManager calls the _transfer(), passing the CapitalPool address as the param for _from.

The only way for the TokenManger to gets approval of the funds in Capital Pool is by calling CapitalPool.sol::approve(). Since there is no allowance yet, the allowance is 0. Both conditions are true.

Then the function execute the code in the if block:

ICapitalPool(_capitalPoolAddr).approve(address(this));

It calls CapitalPool.sol::approve with the address of the TokenManager and not the Token.

This results in the approval failing since it is the wrong address.

Proof of Concept:

Paste the following test in PreMarkets.t.sol:

function test_cant_withdraw_eth() public {
vm.startPrank(user);
preMarktes.createOffer{value: 0.012 * 1e18}(
CreateOfferParams(
marketPlace,
address(weth9),
1000,
0.01 * 1e18,
12000,
300,
OfferType.Ask,
OfferSettleType.Turbo
)
);
address offerAddr = GenerateAddress.generateOfferAddress(0);
vm.stopPrank();
​
deal(user2, 100 * 10 ** 18);
​
vm.startPrank(user2);
preMarktes.createTaker{value: 6175e15}(offerAddr, 500);
vm.stopPrank();
​
vm.startPrank(user1);
uint256 userSalesRevenue1 = tokenManager.userTokenBalanceMap(
address(user),
address(weth9),
TokenBalanceType.SalesRevenue
);
vm.stopPrank();
​
vm.prank(user1);
systemConfig.updateMarket(
"Backpack",
address(mockPointToken),
0.01 * 1e18,
block.timestamp - 1,
3600
);
​
vm.startPrank(user);
mockPointToken.approve(address(tokenManager), 10000 * 10 ** 18);
deliveryPlace.settleAskMaker(offerAddr, 500);
​
console2.log("UserSales Revenue:", userSalesRevenue1);
vm.expectRevert();
tokenManager.withdraw(address(weth9), TokenBalanceType.SalesRevenue);
vm.stopPrank();
}

Impact:

The Users cannot withdraw ETH since the CapitalPool never approves the TokenManager to withdraw the ETH. This also results in ETH being locked inside the protocol since there is no other way to withdraw ETH.

Recommended Mitigation:

if (
_from == _capitalPoolAddr &&
IERC20(_token).allowance(_from, address(this)) == 0x0
) {
- ICapitalPool(_capitalPoolAddr).approve(address(this));
+ ICapitalPool(_capitalPoolAddr).approve(address(_token));
}
Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-TokenManager-approve-wrong-address-input

If we consider the correct permissioned implementation for the `approve()` function within `CapitalPool.sol`, this would be a critical severity issue, because the withdrawal of funds will be permanently blocked and must be rescued by the admin via the `Rescuable.sol` contract, given it will always revert [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/CapitalPool.sol#L36-L38) when attempting to call a non-existent function selector `approve` within the TokenManager contract. The argument up in the air is since the approval function `approve` was made permisionless, the `if` block within the internal `_transfer()` function will never be invoked if somebody beforehand calls approval for the TokenManager for the required token, so the transfer will infact not revert when a withdrawal is invoked. I will leave open for escalation discussions, but based on my first point, I believe high severity is appropriate.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.