Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Wrong transfert of the native token in the `TokenManager::withdraw`, the caller will never receive his fund.

0xrolko

Relevant GitHub Links

https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/TokenManager.sol#L156

https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/TokenManager.sol#L163

Summary

The transfer to be made from capitalPoolAddr to msg.sender is instead sent to address(this), which is the TokenManager contract in which the withdraw function is implemented.

Vulnerability Details

In the TokenManager::withdraw function, when the token to be withdraw is a native token, according to the documentation this token must be transferred from capitalPoolAddr to msg.sender. But currently this token is rather transferred from capitalPoolAddr to the current contract (address(this)).

Impact

When the token to be withdrawn is a native token, the caller(msg.sender) of the TokenManager::withdraw function will receive nothing of what he is supposed to receive; the fund will remain in the contract account.

Tools Used

Manual review.

Recommendations

Change the coed as follows:

function withdraw(
address _tokenAddress,
TokenBalanceType _tokenBalanceType
) external whenNotPaused {
...
​
if (_tokenAddress == wrappedNativeToken) {
/**
* @dev token is native token
* @dev transfer from capital pool to msg sender
* @dev withdraw native token to token manager contract
* @dev transfer native token to msg sender
*/
_transfer(
wrappedNativeToken,
capitalPoolAddr,
- address(this),
+ _msgSender(),
claimAbleAmount,
capitalPoolAddr
);
​
IWrappedNativeToken(wrappedNativeToken).withdraw(claimAbleAmount);
payable(msg.sender).transfer(claimAbleAmount);
} else {
/**
* @dev token is ERC20 token
* @dev transfer from capital pool to msg sender
*/
_safe_transfer_from(
_tokenAddress,
capitalPoolAddr,
_msgSender(),
claimAbleAmount
);
}
​
...
​
}
Updates

Lead Judging Commences

0xnevi Lead Judge
about 1 year ago
0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.