No balance substraction in TokenManager's withdraw function
Summary
The problem in the TokenManager(https://github.com/Cyfrin/2024-08-tadle/blob/main/src/core/TokenManager.sol#L137-L189) withdrawal function. The function checks the available amount for a particular msg.sender, but after transfer it doesn't changing to zero.
Vulnerability Details
Impact
As result everyone who deposited some tokens or native tokens can drain whole contract's balance by withdrawing one claimableAmount many times.
Tools Used
Recommendations
Set userTokenBalanceMap[_msgSender()][_tokenAddress][_tokenBalanceType] in withdraw() function.
Lead Judging Commences
finding-TokenManager-withdraw-userTokenBalanceMap-not-reset
Valid critical severity finding, the lack of clearance of the `userTokenBalanceMap` mapping allows complete draining of the CapitalPool contract. Note: This would require the approval issues highlighted in other issues to be fixed first (i.e. wrong approval address within `_transfer` and lack of approvals within `_safe_transfer_from` during ERC20 withdrawals)
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.