Tadle
Tadle
DeFi
30,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

If a user gets blacklisted they would not be able to withdraw their funds

yotov721

Summary

If a user gets blacklisted they would not be able to withdraw their funds

Vulnerability Details

The protocol lets users trade in an order book like manor and saves the funds in a CapitalPool contract. When a user wants to withdraw the funds he has bough/refunded or acquired in any other way - they call the `TokenManager::withdraw` function.

The problem is caused by the fact that the withdraw process works by sending back all the tokens and that they can only be sent back to the same address from where they were aquired.

Some tokens have blocklists and if the user gets blocklisted they would not be able to withdraw their funds.

Impact

Funds Stuck

Tools Used

Manual review

Recommendations

When redeeming the failed deposits, the easiest and most straightforward solution is to allow the depositor to pass an address where it would like to receive all the deposited tokens.

function withdraw(
address _tokenAddress,
TokenBalanceType _tokenBalanceType,
+ address _receiver
) external whenNotPaused {
uint256 claimAbleAmount = userTokenBalanceMap[_msgSender()][
_tokenAddress
][_tokenBalanceType];
​
if (claimAbleAmount == 0) {
return;
}
​
address capitalPoolAddr = tadleFactory.relatedContracts(
RelatedContractLibraries.CAPITAL_POOL
);
​
if (_tokenAddress == wrappedNativeToken) {
/**
* @dev token is native token
* @dev transfer from capital pool to msg sender
* @dev withdraw native token to token manager contract
* @dev transfer native token to msg sender
*/
_transfer(
wrappedNativeToken,
capitalPoolAddr,
address(this),
claimAbleAmount,
capitalPoolAddr
);
​
IWrappedNativeToken(wrappedNativeToken).withdraw(claimAbleAmount);
- payable(msg.sender).transfer(claimAbleAmount);
+ payable(_receiver).call{value: claimAbleAmount}();
} else {
/**
* @dev token is ERC20 token
* @dev transfer from capital pool to msg sender
*/
_safe_transfer_from(
_tokenAddress,
capitalPoolAddr,
- _msgSender(),
+ _receiver,
claimAbleAmount
);
}
​
emit Withdraw(
_msgSender(),
_tokenAddress,
_tokenBalanceType,
claimAbleAmount
);
}
Updates

Lead Judging Commences

0xnevi Lead Judge
11 months ago
0xnevi Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Known issue

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.