Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

`CapitalPool::approve` is Passed an Incorrect Parameter, Accounts Cannot `withdraw` Any Funds

izuman

Summary

CapitalPool::approve function is pass the incorrect parameters from the TokenManager contract.
TokenManager::withdraw will always revert due to the approve function passed the wrong address.
Accounts will be unable to withdraw anything from the protocol

Vulnerability Details

Here is where the incorrect parameter is passed:

ICapitalPool(_capitalPoolAddr).approve(address(this));

Notice this is called from the TokenManager contract so the address(this) will be the address of the TokenManager contract

Now looking a CapitalPool::approve function here:

function approve(address tokenAddr) external {
address tokenManager = tadleFactory.relatedContracts(
RelatedContractLibraries.TOKEN_MANAGER
);
(bool success, ) = tokenAddr.call(
abi.encodeWithSelector(
APPROVE_SELECTOR,
tokenManager,
type(uint256).max
)
);
​
if (!success) {
revert ApproveFailed();
}
}
}

You can see that the approve function is expecting the tokenAddress not the address of the TokenManager contract.

#PoC
Place the following code into the PreMarkets.t.sol file and run with forge test --mt test_unable_to_withdraw

function test_unable_to_withdraw() public {
vm.startPrank(user);
​
preMarktes.createOffer{value: 0.02 * 1e18}(
CreateOfferParams(
marketPlace, address(weth9), 1000, 0.01 * 1e18, 12000, 300, OfferType.Ask, OfferSettleType.Turbo
)
);
vm.stopPrank();
​
vm.startPrank(user1);
deal(address(weth9), address(user1), 1e18);
deal(address(user1), 1e18);
weth9.approve(address(tokenManager), type(uint256).max);
address stockAddr = GenerateAddress.generateStockAddress(0);
address offerAddr = GenerateAddress.generateOfferAddress(0);
​
preMarktes.createTaker{value: 0.006175 * 1e18}(offerAddr, 500);
vm.stopPrank();
​
vm.prank(user);
preMarktes.abortAskOffer(stockAddr, offerAddr);
vm.startPrank(user1);
address stock1Addr = GenerateAddress.generateStockAddress(1);
preMarktes.abortBidTaker(stock1Addr, offerAddr);
​
vm.startPrank(user);
TokenBalanceType tokenBalanceType = TokenBalanceType.MakerRefund;
console.log("token manager", address(tokenManager));
vm.expectRevert(abi.encodeWithSelector(bytes4(keccak256("ApproveFailed()"))));
tokenManager.withdraw(address(weth9), tokenBalanceType); // <--- when try to withdraw we will revert with ApproveFailed()
vm.stopPrank();
​
vm.stopPrank();
}

Impact

No one will be able to withdraw funds from the contract due to a lack of approval.

Tools Used

Manual review and Foundry

Recommendations

Pass the tokenAddress in TokenManager::_transfer when calling CapitalPool::approve

Make changes here:

- ICapitalPool(_capitalPoolAddr).approve(address(this));
+ ICapitalPool(_capitalPoolAddr).approve(_token);
Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-TokenManager-approve-wrong-address-input

If we consider the correct permissioned implementation for the `approve()` function within `CapitalPool.sol`, this would be a critical severity issue, because the withdrawal of funds will be permanently blocked and must be rescued by the admin via the `Rescuable.sol` contract, given it will always revert [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/CapitalPool.sol#L36-L38) when attempting to call a non-existent function selector `approve` within the TokenManager contract. The argument up in the air is since the approval function `approve` was made permisionless, the `if` block within the internal `_transfer()` function will never be invoked if somebody beforehand calls approval for the TokenManager for the required token, so the transfer will infact not revert when a withdrawal is invoked. I will leave open for escalation discussions, but based on my first point, I believe high severity is appropriate.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.