Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

[H-5] Incorrect Token Approval Address in `_transfer` Function

rio1101

File: TokenManager.sol

Descritption:

The _transfer function aims to transfer ERC20 tokens and handles token approvals if necessary. However, the function currently passes address(this) to the approve function instead of the _token address. This is incorrect because the approve function requires the address of the token to be approved, not the address of the contract making the call. Passing address(this) could result in reverting the transaction as TokenManager has no approval functionality.

function _transfer(
address _token,
//....
) internal {
//....
if (
_from == _capitalPoolAddr &&
IERC20(_token).allowance(_from, address(this)) == 0x0
) {
//@audit - Should pass _token as argument to the approve function instead of address(this)
ICapitalPool(_capitalPoolAddr).approve(address(this));
}
//....
}

Tools Used:

Mannually review

Recommendation:

Update the _transfer function to pass the _token address as an argument to the approve function instead of address(this). This will ensure that the correct token is approved for transfer, aligning with the intended functionality.

function _transfer(
address _token,
//....
) internal {
//....
if (
_from == _capitalPoolAddr &&
IERC20(_token).allowance(_from, address(this)) == 0x0
) {
- ICapitalPool(_capitalPoolAddr).approve(address(this));
+ ICapitalPool(_capitalPoolAddr).approve(_token);
}
//....
}
Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-TokenManager-approve-wrong-address-input

If we consider the correct permissioned implementation for the `approve()` function within `CapitalPool.sol`, this would be a critical severity issue, because the withdrawal of funds will be permanently blocked and must be rescued by the admin via the `Rescuable.sol` contract, given it will always revert [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/CapitalPool.sol#L36-L38) when attempting to call a non-existent function selector `approve` within the TokenManager contract. The argument up in the air is since the approval function `approve` was made permisionless, the `if` block within the internal `_transfer()` function will never be invoked if somebody beforehand calls approval for the TokenManager for the required token, so the transfer will infact not revert when a withdrawal is invoked. I will leave open for escalation discussions, but based on my first point, I believe high severity is appropriate.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.