Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

TokenManager.sol :: _transfer() is approving an incorrect address, causing the transaction to always revert and leaving the funds stuck in the contract.

ivanfitro

Summary

withdraw() is used to transfer tokens from CapitalPool.sol to the user. However, _transfer() uses an incorrect address for the approval, causing the transaction to always revert. As a result, the funds remain permanently stuck in the contract.

Vulnerability Details

withdraw() calls _transfer when _tokenAddress == wrappedNativeToken.

function _transfer(
address _token,
address _from,
address _to,
uint256 _amount,
address _capitalPoolAddr
) internal {
uint256 fromBalanceBef = IERC20(_token).balanceOf(_from);
uint256 toBalanceBef = IERC20(_token).balanceOf(_to);
​
//tokens are sended to capitalPool it needs to aprprove because in withdraw this cotnract will use transferFrom the capitalPool to the user
if (
_from == _capitalPoolAddr &&
IERC20(_token).allowance(_from, address(this)) == 0x0
) {
@> ICapitalPool(_capitalPoolAddr).approve(address(this));
}
​
_safe_transfer_from(_token, _from, _to, _amount);
​
uint256 fromBalanceAft = IERC20(_token).balanceOf(_from);
uint256 toBalanceAft = IERC20(_token).balanceOf(_to);
​
if (fromBalanceAft != fromBalanceBef - _amount) {
revert TransferFailed();
}
​
if (toBalanceAft != toBalanceBef + _amount) {
revert TransferFailed();
}
}

As shown, when the from address is _capitalPoolAddr and the allowance is 0, the contract attempts to call capitalPool to approve TokenManager.sol to spend tokens on its behalf. The issue arises because it's setting address(this) instead of _token.
For clarity, we can refer to the approve() function in CapitalPool.sol.

function approve(address tokenAddr) external {
address tokenManager = tadleFactory.relatedContracts(
RelatedContractLibraries.TOKEN_MANAGER
);
(bool success, ) = tokenAddr.call(
abi.encodeWithSelector(
APPROVE_SELECTOR,
tokenManager,
type(uint256).max
)
);
​
if (!success) {
revert ApproveFailed();
}
}

The parameter for the approve() should be the token address, not the contract that needs approval.

As you can see the address of the TokenManager is obtained via tadleFactory.relatedContracts(RelatedContractLibraries.TOKEN_MANAGER), and then the approve() is called on the token.

The issue with the current implementation is that it attempts to call approve() on TokenManager.sol, which does not have an approve() function. This leads to the transaction always reverting with the custom error ApproveFailed(), resulting in tokens being permanently stuck in CapitalPool.sol.

##POC
To run the POC copy the following code into PreMarkets.t.sol.

function test_ETHwithdrawFail() public {
vm.startPrank(address(preMarktes));
​
deal(address(weth9), address(capitalPool), 1000e18);
deal(address(weth9), 1000 ether);
​
TokenBalanceType tokenType = TokenBalanceType.TaxIncome;
​
//add balance to next withdraw it
tokenManager.addTokenBalance(tokenType, user1, address(weth9), 100e18);
vm.stopPrank();
​
vm.startPrank(user1);
bytes4 selector = bytes4(keccak256("ApproveFailed()"));
vm.expectRevert(selector);
tokenManager.withdraw(address(weth9), tokenType);
​
vm.stopPrank();
}

Impact

The transaction will always revert, causing the funds to remain permanently stuck in the contract and resulting in a loss of funds.

Tools Used

Manual review.

Recommendations

To resolve this issue, modify _transfer() as follows.

function _transfer(
address _token,
address _from,
address _to,
uint256 _amount,
address _capitalPoolAddr
) internal {
uint256 fromBalanceBef = IERC20(_token).balanceOf(_from);
uint256 toBalanceBef = IERC20(_token).balanceOf(_to);
​
//tokens are sended to capitalPool it needs to aprprove because in withdraw this cotnract will use transferFrom the capitalPool to the user
if (
_from == _capitalPoolAddr &&
IERC20(_token).allowance(_from, address(this)) == 0x0
) {
- ICapitalPool(_capitalPoolAddr).approve(address(this));
+ ICapitalPool(_capitalPoolAddr).approve(_token);
}
​
_safe_transfer_from(_token, _from, _to, _amount);
​
uint256 fromBalanceAft = IERC20(_token).balanceOf(_from);
uint256 toBalanceAft = IERC20(_token).balanceOf(_to);
​
if (fromBalanceAft != fromBalanceBef - _amount) {
revert TransferFailed();
}
​
if (toBalanceAft != toBalanceBef + _amount) {
revert TransferFailed();
}
}
Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-TokenManager-approve-wrong-address-input

If we consider the correct permissioned implementation for the `approve()` function within `CapitalPool.sol`, this would be a critical severity issue, because the withdrawal of funds will be permanently blocked and must be rescued by the admin via the `Rescuable.sol` contract, given it will always revert [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/CapitalPool.sol#L36-L38) when attempting to call a non-existent function selector `approve` within the TokenManager contract. The argument up in the air is since the approval function `approve` was made permisionless, the `if` block within the internal `_transfer()` function will never be invoked if somebody beforehand calls approval for the TokenManager for the required token, so the transfer will infact not revert when a withdrawal is invoked. I will leave open for escalation discussions, but based on my first point, I believe high severity is appropriate.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.