Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Any user can approve any token to be withdrawn

dadekuma

Summary

Missing access control on approve allows any user to enable moving funds from the CapitalPool through the TokenManager functions.

Vulnerability Details

There are no checks to ensure that the caller is authorized to approve a token.
The @notice hints that the caller must be the token manager, but this is not implemented:

/**
* @dev Approve token for token manager
* @notice only can be called by token manager
* @param tokenAddr address of token
*/
function approve(address tokenAddr) external {
address tokenManager = tadleFactory.relatedContracts(
RelatedContractLibraries.TOKEN_MANAGER
);
(bool success, ) = tokenAddr.call(
abi.encodeWithSelector(
APPROVE_SELECTOR,
tokenManager,
type(uint256).max
)
);
​
if (!success) {
revert ApproveFailed();
}
}

https://github.com/Cyfrin/2024-08-tadle/blob/main/src/core/CapitalPool.sol#L28

Impact

Impact: Medium (Funds are indirectly at risk because attackers can enable the withdrawals of any token, and the CapitalPool acts as a vault for every market token)
Likelihood: High (Anyone can do it without preconditions)

Risk: Medium

Tools Used

Manual review

Recommendations

In CapitalPool, ensure that the caller is the tokenManager:

function approve(address tokenAddr) external {
address tokenManager = tadleFactory.relatedContracts(
RelatedContractLibraries.TOKEN_MANAGER
);
+ if (msg.sender != tokenManager) {
+ revert("not authorized");
+ }
(bool success, ) = tokenAddr.call(
abi.encodeWithSelector(
APPROVE_SELECTOR,
tokenManager,
type(uint256).max
)
);
​
if (!success) {
revert ApproveFailed();
}
}
Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-CapitalPool-approve-missing-access-control

This is at most low severity, even though giving max approvals shouldn't be permisionless, the respective tokenManager address is retrieved from the TadleFactory contract whereby the trusted guardian role is responsible for deploying such contracts as seen [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/factory/TadleFactory.sol#L68). Since the user still has to go through the PreMarkets/DeliveryPlace contracts to perform market actions, this max approval cannot be exploited.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.