In Magnetar a user can batch a lot of calls to the Tapioca ecosystem. One of these is the MagnetarAction.Permit. This performs various permit operations, Magnetar::_processPermitOperation:
Lets also have a look at MagnetarStorage::_checkSender:
Here, the first argument to whatever call is done in _processPermitOperation is checked. The important thing here is that it always passes if the first argument is msg.sender.
This is troublesome for the calls: IYieldBox::setApprovalForAll, IYieldBox::setApprovalForAsset, IERC20::approve, and IERC721::approve. As they all have the operator/approvee as the first argument and use msg.sender as the owner.
Hence, any of these calls would pass with msg.sender, granting allowance from Magnetar to msg.sender which can be any user.
Any user can steal any whitelisted tokens held by Magnetar. However, as Magnetar is just a helper contract it is not supposed to hold any tokens.
Test in tap-token/test/MagnetarApproval.t.sol:
Full test code can be found here.
Consider rethinking how MagnetarAction.Permit should work, as there is support in modules for a lot of the calls it is used for. Perhaps it is unnecessary to have.
