Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Wrong parameter passed to capitalToken approve function in TokenManager _transfer()

praise03

Summary

Withdrawals of wrappedNativeTokens revert due to wrong parameter passed to capitalPool.approve

Vulnerability Details

https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/TokenManager.sol#L247

The line of code above is meant to approve the TokenManager to transfer tokens on behalf of the capitalPool, however the wrong parameter is passed to the function (tokenManagers address is passed instead of the nativeToken address). This will always lead to a ApproveFailed() revert.

function test_ask_offer_protected_eth() public {
​
vm.prank(user1);
systemConfig.updateReferralExtraRateMap(user, 50_000);
​
systemConfig.updateReferrerInfo(user, 300_000 , 50_000);
​
vm.startPrank(user);
​
preMarktes.createOffer{value: 0.012 * 1e18}(
CreateOfferParams(
marketPlace,
address(weth9),
1000,
0.01 * 1e18,
12000,
300,
OfferType.Ask,
OfferSettleType.Protected
)
);
​
address offerAddr = GenerateAddress.generateOfferAddress(0);
preMarktes.createTaker{value: 0.005175 * 1e18}(offerAddr, 500);
​
address stock1Addr = GenerateAddress.generateStockAddress(1);
preMarktes.listOffer{value: 0.0072 * 1e18}(
stock1Addr,
0.006 * 1e18,
12000
);
​
address offer1Addr = GenerateAddress.generateOfferAddress(1);
preMarktes.closeOffer(stock1Addr, offer1Addr);
// preMarktes.relistOffer{value: 0.0072 * 1e18}(stock1Addr, offer1Addr);
​
vm.stopPrank();
​
TokenBalanceType tbt = TokenBalanceType.ReferralBonus;
​
uint256 expectedReward = tokenManager.userTokenBalanceMap(user, address(weth9), tbt);
​
//manualy approve
// capitalPool.approve(address(weth9));
​
//will always revert with ApprovalFailed error
vm.expectRevert();
vm.prank(user);
tokenManager.withdraw(address(weth9), tbt);
}

Impact

Users cannot withdraw native tokens unless approval is manually granted by the owner

Tools Used

Manual Review

Recommendations

Replace

ICapitalPool(_capitalPoolAddr).approve(address(this));

with:

ICapitalPool(_capitalPoolAddr).approve(_token);
Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-TokenManager-approve-wrong-address-input

If we consider the correct permissioned implementation for the `approve()` function within `CapitalPool.sol`, this would be a critical severity issue, because the withdrawal of funds will be permanently blocked and must be rescued by the admin via the `Rescuable.sol` contract, given it will always revert [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/CapitalPool.sol#L36-L38) when attempting to call a non-existent function selector `approve` within the TokenManager contract. The argument up in the air is since the approval function `approve` was made permisionless, the `if` block within the internal `_transfer()` function will never be invoked if somebody beforehand calls approval for the TokenManager for the required token, so the transfer will infact not revert when a withdrawal is invoked. I will leave open for escalation discussions, but based on my first point, I believe high severity is appropriate.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.