Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

CapitalPool::approve() operates on arbitrary address, there is no access control applied

ravikiranweb3

Summary

CapitalPool::approve() operates on arbitrary address, could be vulnerable to gas grieving and return bomb attack. The risk originates due to the fact, that there is no access control applied.

Vulnerability Details

a) gas grieving
As an arbitrary address, the call flow will be passed into the arbitrary address. The contract could consume all gas. As there is no gas limit applied in the call, it could be abused.

b) Return bomb attack
The arbitrary address can potentially return a very large data as result for the call, leading to consumption of gas as part of copying the data into memory. The gas will be consumed even in the case the data is not being read by the calling contract.

c) DOS
Potential for DOS as there is not limit of what the called contract can do resulting in DOS.

Impact

Tools Used

Manual Review

Recommendations

Considering the context in which approve is being user, the CapitalPool::approve()should be restricted to be called by TokenManagercontract only.

function approve(address tokenAddr) external {
address tokenManager = tadleFactory.relatedContracts(
RelatedContractLibraries.TOKEN_MANAGER
);
+ require(tokenManager== msg.sender,"Not Authorized");
(bool success, ) = tokenAddr.call(
abi.encodeWithSelector(
APPROVE_SELECTOR,
tokenManager,
type(uint256).max
)
);
​
if (!success) {
revert ApproveFailed();
}
}

Additional steps:

a) apply gas limit which can be configured
b) use YUL to limit the size of return data that the calling contract will read.
c) use Admin whitelisting to restrict the contracts being called

Updates

Lead Judging Commences

0xnevi Lead Judge 12 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-CapitalPool-approve-missing-access-control

This is at most low severity, even though giving max approvals shouldn't be permisionless, the respective tokenManager address is retrieved from the TadleFactory contract whereby the trusted guardian role is responsible for deploying such contracts as seen [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/factory/TadleFactory.sol#L68). Since the user still has to go through the PreMarkets/DeliveryPlace contracts to perform market actions, this max approval cannot be exploited.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.