Tadle
Tadle
DeFi
30,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Absence of a `receive()` Function in `TokenManager.sol` Prevents WETH Withdrawal.

nikhil20

Summary

The TokenManager:withdraw function is used to withdraw users' funds. If the token address is wrappedNativeToken, it attempts to unwrap WETH into ETH. However, this process fails because the TokenManager contract lacks a receive function.

Vulnerability Details

When the TokenManager:withdraw function tries to unwrap WETH into ETH using the following code:

IWrappedNativeToken(wrappedNativeToken).withdraw(claimAbleAmount);

The wrappedNativeToken contract will attempt to send ETH to the TokenManager contract. Since the TokenManager contract does not have a receive function, the transaction will fail, causing the withdrawal process to fail.

Impact

This vulnerability results in the locking of funds, as users will be unable to successfully withdraw their WETH.

Tools Used

Manual

Recommendations

Add a receive function in the TokenManager.

Updates

Lead Judging Commences

0xnevi Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

[invalid] finding-TokenManager-no-native-ETH-receive

Invalid, TokenManager is the implementation contract of 9the transparent upgradeable proxy, as can seen by the comments [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/proxy/UpgradeableProxy.sol#L15). The receive payable is implemented as seen [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/proxy/UpgradeableProxy.sol#L37)

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.