Tadle
Tadle
DeFi
30,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Ether can get stuck in TokenManager.sol due to missing logic

wellbyt3

Summary

In TokenManager.sol the tillIn() function is used to transfer either ether or whitelisted ERC20s to CapitalPool.sol.

If ether is sent in the msg.value, but an ERC20 token address is passed as a parameter, the ether that was sent will be locked in TokenManager.sol and unable to be retrieved.

Vulnerability Details

This finding is different than the Medium in the automated report because the tokens are being locked in TokenManager.sol, not PreMarkets.sol.

Here's a POC calling createOffer() in Premarkets.sol which calls tillIn(), but there are other function calls where this is also possible.

Add to Premarkets.t.sol:

function testLockEtherInTokenManager() public {
vm.startPrank(user);
// sending msg.value
preMarktes.createOffer{value: 0.012 * 1e18}(
CreateOfferParams(
marketPlace,
address(mockUSDCToken), // USDC token address
1000,
0.01 * 1e18,
12000,
300,
OfferType.Ask,
OfferSettleType.Protected
)
);
// TokenManager address has a balance now of 0.012 * 1e18
assertEq(address(tokenManager).balance, 0.012 * 1e18);
vm.stopPrank();
}

Impact

User funds are locked in TokenManager.sol

Tools Used

Manual Review / Foundry

Recommendations

Add a check in any payable function that calls tillIn() that if there is a non-zero msg.value, the tokenAddress should be the wrapped native token.

Updates

Lead Judging Commences

0xnevi Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

[invalid] finding-TokenManager-tillin-excess

Invalid, these are by default, invalid based on codehawks [general guidelines](https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity#findings-that-may-be-invalid). The check implemented is simply a sufficiency check, it is users responsibility to only send an appropriate amount of native tokens where amount == msg.value when native token is intended to be used as collateral (which will subsequently be deposited as wrapped token). All excess ETH can be rescued using the `Rescuable.sol` contract. > Users sending ETH/native tokens > If contracts allow users to send tokens acc111identally.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.