Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

When TokenManager calls approve in CapitalPool during withdrawal, the forwarded parameter is wrong

fyamf

Summary

Since the allowance from CapitalPool to TokenManager is zero, during the withdrawal of WETH, this allowance should be increased. But, due to wrong implementation, it will revert.

This clearly leads to stuck of funds in the protocol.

Vulnerability Details

During withdrawing, if the token address is WETH, then the function _transfer is called to transfer required WETH from the CapitalPool to the caller.

​
if (_tokenAddress == wrappedNativeToken) {
/**
* @dev token is native token
* @dev transfer from capital pool to msg sender
* @dev withdraw native token to token manager contract
* @dev transfer native token to msg sender
*/
_transfer(
wrappedNativeToken,
capitalPoolAddr,
address(this),
claimAbleAmount,
capitalPoolAddr
);
​
IWrappedNativeToken(wrappedNativeToken).withdraw(claimAbleAmount);
payable(msg.sender).transfer(claimAbleAmount);
}

https://github.com/Cyfrin/2024-08-tadle/blob/main/src/core/TokenManager.sol#L160

In this function, if allowance of CapitalPool to the TokenManager is zero, then the function approve in CapitalPool is called to give allowance to TokenManager.

if (
_from == _capitalPoolAddr &&
IERC20(_token).allowance(_from, address(this)) == 0x0
) {
ICapitalPool(_capitalPoolAddr).approve(address(this));
}

https://github.com/Cyfrin/2024-08-tadle/blob/main/src/core/TokenManager.sol#L247

function approve(address tokenAddr) external {
address tokenManager = tadleFactory.relatedContracts(
RelatedContractLibraries.TOKEN_MANAGER
);
(bool success, ) = tokenAddr.call(
abi.encodeWithSelector(
APPROVE_SELECTOR,
tokenManager,
type(uint256).max
)
);
​
if (!success) {
revert ApproveFailed();
}
}

https://github.com/Cyfrin/2024-08-tadle/blob/main/src/core/CapitalPool.sol#L24

The issue is that the parameter of the function approve should be the address of the token WETH, but the protocol by mistake inserted address(this) as parameter.

ICapitalPool(_capitalPoolAddr).approve(address(this));

https://github.com/Cyfrin/2024-08-tadle/blob/main/src/core/TokenManager.sol#L247

This leads to revert, because in CapitalPool, it is expecting the token address is forwarded as the parameter. So, the low-level call would be unsuccessful, and it reverts by ApproveFailed.

(bool success, ) = tokenAddr.call(
abi.encodeWithSelector(
APPROVE_SELECTOR,
tokenManager,
type(uint256).max
)
);

https://github.com/Cyfrin/2024-08-tadle/blob/main/src/core/CapitalPool.sol#L28

PoC

In the following test, a maker creates an ask offer with WETH as collateral, and later he closes it. Later the maker intends to withdraw his collateral. By, calling the function withdraw, it will revert, and he will not be able to withdraw.

function test_withdraw_impossible() public {
address Alice = vm.addr(10); // maker
deal(Alice, 1 * 10 ** 18);
​
////// Alice(maker) creates an ask offer
vm.startPrank(Alice);
​
preMarktes.createOffer{value: 0.012 * 1e18}(
CreateOfferParams(
marketPlace,
address(weth9),
1000,
0.01 * 1e18,
12000,
300,
OfferType.Ask,
OfferSettleType.Turbo
)
);
​
address stockAddr = GenerateAddress.generateStockAddress(0);
address offerAddr = GenerateAddress.generateOfferAddress(0);
​
preMarktes.closeOffer(stockAddr, offerAddr);
​
console.log(
"Alice balance of WETH in the protocol: ",
tokenManager.userTokenBalanceMap(
address(Alice),
address(weth9),
TokenBalanceType.MakerRefund
)
);
​
tokenManager.withdraw(address(weth9), TokenBalanceType.MakerRefund);
}

Impact

  • Stuck of fund in the protocol.

  • Users who deposits WETH as collateral, will not be able to withdraw them.

Tools Used

Recommendations

Following modification is recommended:

ICapitalPool(_capitalPoolAddr).approve(_token);

https://github.com/Cyfrin/2024-08-tadle/blob/main/src/core/TokenManager.sol#L247

Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-TokenManager-approve-wrong-address-input

If we consider the correct permissioned implementation for the `approve()` function within `CapitalPool.sol`, this would be a critical severity issue, because the withdrawal of funds will be permanently blocked and must be rescued by the admin via the `Rescuable.sol` contract, given it will always revert [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/CapitalPool.sol#L36-L38) when attempting to call a non-existent function selector `approve` within the TokenManager contract. The argument up in the air is since the approval function `approve` was made permisionless, the `if` block within the internal `_transfer()` function will never be invoked if somebody beforehand calls approval for the TokenManager for the required token, so the transfer will infact not revert when a withdrawal is invoked. I will leave open for escalation discussions, but based on my first point, I believe high severity is appropriate.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.