Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

`userTokenBalanceMap` is Not Changed After `Withdraw`

jesjupyter

Summary

The TokenManager::withdraw function in the Tadle system allows users to withdraw claimable funds from the CapitalPool. However, the function fails to update the userTokenBalanceMap after a withdrawal, allowing users to repeatedly withdraw the same funds multiple times. This oversight can lead to the complete draining of the CapitalPool.

Vulnerability Details

The userTokenBalanceMap in the TokenManager contract tracks the claimable token balance for each user. The TokenManager::withdraw function allows users to withdraw these claimable funds. However, the function does not update the userTokenBalanceMap after a withdrawal is made, which creates a critical vulnerability.

function withdraw(
address _tokenAddress,
TokenBalanceType _tokenBalanceType
) external whenNotPaused {
@=> uint256 claimAbleAmount = userTokenBalanceMap[_msgSender()][
_tokenAddress
][_tokenBalanceType];
​
if (claimAbleAmount == 0) {
return;
}
​
address capitalPoolAddr = tadleFactory.relatedContracts(
RelatedContractLibraries.CAPITAL_POOL
);
​
if (_tokenAddress == wrappedNativeToken) {
/**
* @dev token is native token
* @dev transfer from capital pool to msg sender
* @dev withdraw native token to token manager contract
* @dev transfer native token to msg sender
*/
_transfer(
wrappedNativeToken,
capitalPoolAddr,
address(this),
claimAbleAmount,
capitalPoolAddr
);
​
IWrappedNativeToken(wrappedNativeToken).withdraw(claimAbleAmount);
payable(msg.sender).transfer(claimAbleAmount);
} else {
/**
* @dev token is ERC20 token
* @dev transfer from capital pool to msg sender
*/
_safe_transfer_from(
_tokenAddress,
capitalPoolAddr,
_msgSender(),
claimAbleAmount
);
}
​
emit Withdraw(
_msgSender(),
_tokenAddress,
_tokenBalanceType,
claimAbleAmount
);
}

The function retrieves the claimable amount from userTokenBalanceMap but does not reset this balance after the withdrawal. As a result, users can repeatedly call the withdraw function to withdraw the same amount of tokens multiple times. This oversight can lead to the complete draining of the CapitalPoolfor a specific ERC20 token.

Impact

The vulnerability has a high impact as it allows users to repeatedly withdraw funds, leading to the potential depletion of the CapitalPool. This could result in significant financial losses and a complete failure of the system’s economic model.

Tools Used

Manual

Recommendations

The userTokenBalanceMap should be updated after a withdrawal to prevent further claims on the same funds. Specifically, set the user’s balance to zero after the withdrawal.

Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-TokenManager-withdraw-userTokenBalanceMap-not-reset

Valid critical severity finding, the lack of clearance of the `userTokenBalanceMap` mapping allows complete draining of the CapitalPool contract. Note: This would require the approval issues highlighted in other issues to be fixed first (i.e. wrong approval address within `_transfer` and lack of approvals within `_safe_transfer_from` during ERC20 withdrawals)

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.