First Flight #21: KittyFi
First Flight #21
Beginner FriendlyDeFiFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Potential inability to withdraw collaterals at desired times due to Insufficient balance in the KittyVault

14xSachet

Summary

The function executeWhiskdrawal of the KittyVault contract calculates the amount of collateral to be withdrawn based on the ratio of CattyNip to total collateral in the vault. However, if a portion of the collateral is supplied to the Aave protocol, the vault may not have a sufficient balance to complete the withdrawal.

Vulnerability Details

Suppose a user wants to withdraw the collateral that had deposited earlier into the vault. But all the collateral in the vault is supplied to the Aave Pool to earn interest, so the vault balance stand to less than what user wants to withdraw. This will revert the transaction during the withdrawal and thus users will not be able to withdraw their collateral at desired times.

Impact

Users may not be able to withdraw their collateral whenever they desire, as the withdrawal may revert due to insufficient balance in the vault. This could lead to user dissatisfaction, disruption of the application's functionality, and potential financial losses for the users.

Tools Used

VScode

Recommendations

function executeWhiskdrawal(address _user, uint256 _cattyNipToWithdraw) external onlyPool {
uint256 _ameownt = _cattyNipToWithdraw.mulDiv(getTotalMeowllateral(), totalCattyNip);
userToCattyNip[_user] -= _cattyNipToWithdraw;
totalCattyNip -= _cattyNipToWithdraw;
+ if(totalMeowllateralInVault<ameownt){
+ purrrCollateralFromAave(ameownt-totalMeowllateralInVault +1);
+ }
totalMeowllateralInVault -= _ameownt;
IERC20(i_token).safeTransfer(_user, _ameownt);
}
Updates

Lead Judging Commences

shikhar229169 Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Users can't withdraw meowllateral if requested amount is not present in vault as it is supplied to Aave

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.