Tadle
Tadle
DeFi
30,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Missing access control modifier in `approve` function of `CapitalPool.sol` , anyone can approve tokens

tdey

Vulnerability Details

As per the comments of the approvefunction

/**
* @dev Approve token for token manager
* @notice only can be called by token manager
* @param tokenAddr address of token
*/

We can see that it is only supposed to be called by token manager, but the function doesn't have any access control modifier to make sure it can only be called by the token manager.

function approve(address tokenAddr) external {...}

Link to code: https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/CapitalPool.sol#L19-L39

Impact

Anyone can call the function and approve tokens, which is undesired

Tools Used

Manual review

Recommendations

Use access control modifier. For example:

modifier isTokenManager() {
require(msg.sender == tokenManager, "Caller is not the token manager");
_;
}
Updates

Lead Judging Commences

0xnevi Lead Judge 9 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-CapitalPool-approve-missing-access-control

This is at most low severity, even though giving max approvals shouldn't be permisionless, the respective tokenManager address is retrieved from the TadleFactory contract whereby the trusted guardian role is responsible for deploying such contracts as seen [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/factory/TadleFactory.sol#L68). Since the user still has to go through the PreMarkets/DeliveryPlace contracts to perform market actions, this max approval cannot be exploited.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.