The Standard
The Standard
DeFiHardhat
20,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

inability to remove collateral due to removal of accepted token in SmartVaultV3

zach030

Summary

A critical vulnerability exists in the SmartVaultV3 contract, where the vault owner is unable to withdraw collateral due to the removal of an accepted token in the TokenManager contract.
This issue leads to the collateral becoming immobile and non-liquidatable within the vault.

Vulnerability Details

The vulnerability resides in the removeCollateral and removeCollateralNative functions of the SmartVaultV3 contract. These functions, designed for collateral removal, first retrieve the token by its symbol:

function removeCollateralNative(uint256 _amount, address payable _to) external onlyOwner {
require(canRemoveCollateral(getTokenManager().getToken(NATIVE), _amount), UNDER_COLL);
(bool sent,) = _to.call{value: _amount}("");
require(sent, "err-native-call");
emit CollateralRemoved(NATIVE, _amount, _to);
}
​
function removeCollateral(bytes32 _symbol, uint256 _amount, address _to) external onlyOwner {
ITokenManager.Token memory token = getTokenManager().getToken(_symbol);
require(canRemoveCollateral(token, _amount), UNDER_COLL);
IERC20(token.addr).safeTransfer(_to, _amount);
emit CollateralRemoved(_symbol, _amount, _to);
}

However, a critical issue arises with the TokenManagerMock contract, where the owner is granted the capability to remove an accepted token.
This can be observed in the contract code, available at this GitHub repository.

The removal of an accepted token by the owner triggers a problematic scenario in the SmartVaultV3 contract.
Post removal, the owner becomes incapable of removing any collateral from the vault. Consequently, these assets, now stuck within the vault, cannot be subjected to liquidation processes.

Impact

Locked collateral represents a direct financial risk to vault owners.

Tools Used

Manual Review

Recommendations

Implement a safeguard mechanism to allow collateral withdrawal regardless of its status in the TokenManager.

Updates

Lead Judging Commences

hrishibhat Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

remove-token

hrishibhat Lead Judge almost 2 years ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!