Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect Share Owner Parameter in `LendingPool._withdrawFromVault()`

gajiknownnothing

Summary

The LendingPool::_withdrawFromVault() function incorrectly sets the owner parameter of the Curve vault.withdraw() function to msg.sender. According to the Curve Vault implementation, the owner parameter should be the address holding the vault shares, which is the LendingPool contract itself (address(this)). This incorrect integration causes withdrawals from the Curve Vault to fail.

Vulnerability Details

In _depositIntoVault(), vault shares are sent to the LendingPool contract (address(this)):

function _depositIntoVault(uint256 amount) internal {
IERC20(reserve.reserveAssetAddress).approve(address(curveVault), amount);
> curveVault.deposit(amount, address(this));
totalVaultDeposits += amount;
}

The owner parameter in the curveVault.withdraw() function is set to msg.sender, but it should be address(this) (the LendingPool contract) because the LendingPool is the owner of the vault shares. This mismatch prevents the withdrawal from succeeding, as the Curve Vault expects the share owner to authorize the withdrawal:

function _withdrawFromVault(uint256 amount) internal {
curveVault.withdraw(amount, address(this), msg.sender, 0, new address[](0));
totalVaultDeposits -= amount;
}

Impact

Withdrawals from the Curve Vault will fail, preventing the LendingPool from retrieving assets from the Curve vault.

Tools Used

vscode

Recommendations

Update the _withdrawFromVault() function to set the owner parameter to address(this) (the LendingPool contract).

Updates

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_withdrawFromVault incorrectly uses msg.sender instead of address(this) as the owner parameter, causing vault withdrawals to fail

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_withdrawFromVault incorrectly uses msg.sender instead of address(this) as the owner parameter, causing vault withdrawals to fail

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.