Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Point tokens can bypass the whitelist check entirely

topstar

https://github.com/tadle-com/market-evm/blob/main/src/core/TokenManager.sol#L32-L38

Summary

The TokenManager contract contains a mechanism for whitelisting tokens using the onlyInTokenWhiteList modifier. However, there are gaps in the logic that may allow non-whitelisted point tokens to be used without proper restrictions. This can lead to security issues if unchecked addresses or unauthorized tokens are mistakenly or maliciously interacted with.

Vulnerability Details

Improper token whitelisting checks:

TokenManager.sol
30: modifier onlyInTokenWhiteList(bool _isPointToken, address _tokenAddress) {
31: if (!_isPointToken && !tokenWhiteListed[_tokenAddress]) {
32: revert TokenIsNotWhiteListed(_tokenAddress);
33: }
34:
35: _;
36: }

Explanation:

The onlyInTokenWhiteList modifier is designed to restrict operations to whitelisted tokens. However, the current logic allows point tokens to bypass the whitelist check entirely if _isPointToken is true.
There is no verification of the _tokenAddress when _isPointToken is true. This can lead to situations where arbitrary addresses might be used as point tokens, bypassing intended security restrictions.

Impact

Allowing unchecked point tokens can lead to unauthorized interactions, including using malicious contracts as point tokens. This may expose the contract to various security risks, including unintended token interactions and loss of funds.

Tools Used

Manual review

Recommendations

Ensure that point tokens also undergo a proper whitelist check or have a separate list of allowed point tokens.

modifier onlyInTokenWhiteList(bool _isPointToken, address _tokenAddress) {
if (!_isPointToken && !tokenWhiteListed[_tokenAddress]) {
revert TokenIsNotWhiteListed(_tokenAddress);
}
​
+ if (_isPointToken) {
+ require(_tokenAddress != address(0), "Invalid point token address");
+ require(pointTokenAllowed[_tokenAddress], "Point token not allowed");
+ }
_;
}

Add a non-zero address check to prevent the use of zero address as a token and maintain separate lists for Point and Non-point Tokens

Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

[invalid] finding-TokenManager-onlyInTokenWhiteList-bypass

Invalid, point tokens need not be whitelisted, since they are subjected to the free market to allow free trading within Tadle with the original collateral backing. Since collateral tokens are the subject of focus when valuing points traded, the whitelist is only applicable to them.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.