Tadle
Tadle
DeFi
30,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Balance Update Flaw in `TokenManager::withdraw` leads to user Draining Protocol Funds

0xcontrol

Description

A critical vulnerability in the withdrawal mechanism allows users to withdraw funds belonging to other users. This issue stems from the protocol's failure to decrease a user's balance after a withdrawal, enabling repeated withdrawals until the entire balance is depleted.

Impact

  • Users can withdraw more funds than they deposited.

  • Potential for complete drainage of the protocols balance.

Step by step proof of concept

  1. Attacker deposits minimal required collateral.

  2. Attacker creates and then aborts an offer.

  3. Attacker calls withdraw function repeatedly.

  4. Each withdrawal succeeds without reducing the attacker's balance.

  5. Process continues until the contract is emptied.

  • this below is also the withdraw function without the protocol decreasing the withdrawed balance

function withdraw(
address _tokenAddress,
TokenBalanceType _tokenBalanceType
) external whenNotPaused {
uint256 claimAbleAmount = userTokenBalanceMap[_msgSender()][
_tokenAddress
][_tokenBalanceType];
​
if (claimAbleAmount == 0) {
return;
}
​
address capitalPoolAddr = tadleFactory.relatedContracts(
RelatedContractLibraries.CAPITAL_POOL
);
​
if (_tokenAddress == wrappedNativeToken) {
/**
* @dev token is native token
* @dev transfer from capital pool to msg sender
* @dev withdraw native token to token manager contract
* @dev transfer native token to msg sender
*/
_transfer(
wrappedNativeToken,
capitalPoolAddr,
address(this),
claimAbleAmount,
capitalPoolAddr
);
​
IWrappedNativeToken(wrappedNativeToken).withdraw(claimAbleAmount);
payable(msg.sender).transfer(claimAbleAmount);
} else {
/**
* @dev token is ERC20 token
* @dev transfer from capital pool to msg sender
*/
_safe_transfer_from(
_tokenAddress,
capitalPoolAddr,
_msgSender(),
claimAbleAmount
);
}
​
emit Withdraw(
_msgSender(),
_tokenAddress,
_tokenBalanceType,
claimAbleAmount
);
}

Recommended Mitigation

  • implement code that will decrease the balance of a user each time someone withdraw his balance

Updates

Lead Judging Commences

0xnevi Lead Judge 11 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-TokenManager-withdraw-userTokenBalanceMap-not-reset

Valid critical severity finding, the lack of clearance of the `userTokenBalanceMap` mapping allows complete draining of the CapitalPool contract. Note: This would require the approval issues highlighted in other issues to be fixed first (i.e. wrong approval address within `_transfer` and lack of approvals within `_safe_transfer_from` during ERC20 withdrawals)

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.