Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Lack of access control in CapitalPool approve

tinnohofficial

Summary

There is no access control in CapitalPool::approve function thus allowing anyone to call it while the notice clearly says it should only be called by the token manager.

Vulnerability Details

The notice @notice only can be called by token manager is misleading says the only allowed caller is token manager but any one call the function (no access control). Thus there is contradiction between notice and code implementation as seen below.

/**
* @dev Approve token for token manager
* @notice only can be called by token manager
* @param tokenAddr address of token
*/
function approve(address tokenAddr) external {
address tokenManager = tadleFactory.relatedContracts(
RelatedContractLibraries.TOKEN_MANAGER
);
(bool success, ) = tokenAddr.call(
abi.encodeWithSelector(
APPROVE_SELECTOR,
tokenManager,
type(uint256).max
)
);
​
if (!success) {
revert ApproveFailed();
}
}

Impact

Anyone can approve the tokenManager to spend tokens for any arbitrary token.

Tools Used

Manual review

Recommendations

  1. If the desired behavior is for the function to be called by anyone then remove the notice @notice only can be called by token manager since it is misleading.

  2. Otherwise, Within the approve function, add access control for example require(msg.sender == tokenManager, "unauthorized") or a better option would be if statement using a Custom Error.

Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-CapitalPool-approve-missing-access-control

This is at most low severity, even though giving max approvals shouldn't be permisionless, the respective tokenManager address is retrieved from the TadleFactory contract whereby the trusted guardian role is responsible for deploying such contracts as seen [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/factory/TadleFactory.sol#L68). Since the user still has to go through the PreMarkets/DeliveryPlace contracts to perform market actions, this max approval cannot be exploited.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.