Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

rebalanceLiquidity will fail in most of the cases.

nikhil20

Summary

rebalanceLiquidity is the function which maintain the 20:80 ratio of asset tokens in the RToken contract and curve vault. But this will get failed in most of the cases.

Vulnerability Details

When user will try to deposit function using the function LendingPool::deposit the execution will go as following deposit => ReserveLibrary::deposit in the function ReserveLibrary::deposit, the asset tokens will be transferred to the Rtoken address as we can see below.

updateReserveInterests(reserve, rateData);
​
IERC20(reserve.reserveAssetAddress).safeTransferFrom(
msg.sender,
reserve.reserveRTokenAddress, // to
amount
);

Later in the execution _rebalanceLiquidity function will be called to maintain the ratio. And in case of currentBuffer > desiredBuffer the _depositIntoVault(excess); function will be called, which will call the deposit function in the curve vault, but this will get failed, as the RToken contract hold the assets not the Lending Pool, so the deposit into the vault will get failed.

function _depositIntoVault(uint256 amount) internal {
IERC20(reserve.reserveAssetAddress).approve(address(curveVault), amount);
curveVault.deposit(amount, address(this));
totalVaultDeposits += amount;
}

Impact

rebalanceLiquidity will not work as intended and deposits will get failed.

Tools Used

Manual Review

Recommendations

First transfer the tokens to the LendingPool and after the liquidity balance the left amount should be transferred tot he RToken contract

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_depositIntoVault and _withdrawFromVault don't transfer tokens between RToken and LendingPool, breaking Curve vault interactions

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_depositIntoVault and _withdrawFromVault don't transfer tokens between RToken and LendingPool, breaking Curve vault interactions

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.