Tadle

Summary

Within the TokenManager contract, there is "no" implementation of the receive() or fallback() function to receive the native ETH-sent.

This lead the TokenManager contract to failing to receive the native ETH-sent from the WETH contract - when the IWrappedNativeToken(wrappedNativeToken)#withdraw() is called via the TokenManager#withdraw().

This result in that a deposited-collateral of the caller (msg.sender) of the TokenManager#withdraw() is stuck forever inside the TokenManager contract.

Vulnerability Details

When a user would like to withdraw their deposited-collateral (native ETH) from the CapitalPool contract, the user would call the TokenManager#withdraw().

Within the TokenManager#withdraw(), the following three steps would be proceeded:

• 1/ WETH (wrappedNativeToken) would be transferred from the CapitalPool contract (capitalPoolAddr) to the TokenManager contract (address(this)).

• 2/ Then, the claimAbleAmount of the native ETH would be withdrawn from the WETH contract (IWrappedNativeToken(wrappedNativeToken)) to the TokenManager contract (address(this)).

• 3/ Finally, the claimAbleAmount of the native ETH-withdrawn would be transferred from the TokenManager contract (address(this)) to the user (msg.sender).
  https://github.com/Cyfrin/2024-08-tadle/blob/main/src/core/TokenManager.sol#L160-L166
  https://github.com/Cyfrin/2024-08-tadle/blob/main/src/core/TokenManager.sol#L168
  https://github.com/Cyfrin/2024-08-tadle/blob/main/src/core/TokenManager.sol#L169

When the step 2/ above, the claimAbleAmount of the native ETH would be transferred from the WETH contract to the TokenManager contract via the IWrappedNativeToken(wrappedNativeToken).withdraw(claimAbleAmount) like this:
https://github.com/Cyfrin/2024-08-tadle/blob/main/src/core/TokenManager.sol#L168

According to the Solidity's documentation, the receive() or fallback() function must be implemented for a smart contract to receive the native ETH-sent.

However, within the TokenManager contract, there is "no" implementation of the receive() or fallback() function to receive the native ETH-sent.

This lead the TokenManager contract to failing to receive (the claimAbleAmount of) the native ETH-sent from the WETH contract - when the IWrappedNativeToken(wrappedNativeToken)#withdraw() is called via the TokenManager#withdraw().
(NOTE：At this point, the TX of the TokenManager#withdraw() will be reverted)

Impact

This lead a deposited-collateral of the caller (msg.sender) of the TokenManager#withdraw() to being stuck forever inside the TokenManager contract.

Tools Used

• Foundry

Recommendations

Within the TokenManager contract, consider implementing the receive() or fallback() - so that the TokenManager contract can receive the native ETH-sent from the WETH contract when the IWrappedNativeToken(wrappedNativeToken)#withdraw() is called via the TokenManager#withdraw().