Vulnerability Details

The approve function in the CapitalPool contract is designed to allow the tokenManager to approve itself for spending tokens from the CapitalPool. However, the current implementation lacks proper access control checks, which could allow unauthorized addresses to call the approve function. This can lead to unintended consequences, such as unauthorized approvals and potential misuse of tokens held by the CapitalPool.

Impact

The lack of proper access control in the approve function could allow any external caller to execute the function. This would enable unauthorized approvals, potentially leading to significant financial loss if tokens are drained or misappropriated by malicious actors.

Proof of Concept

An attacker can simply call the approve function using any arbitrary address, bypassing the intended restriction that only the tokenManager should be able to call this function:

Tools Used

Manual review

Recommendations

To fix this issue, the approve function should include an access control modifier (e.g., onlyTokenManager) that restricts its execution to the tokenManager only. Here’s an updated implementation: