Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Unutilized liquidity not yielding interest without _rebalanceLiquidity() calls

newspacexyz

Summary

The protocol fails to deposit excess liquidity into the Curve vault after debt repayment or liquidation, leading to idle capital that does not generate yield. _rebalanceLiquidity() is not called in _repay() and finalizeLiquidation().

Vulnerability Details

function _repay(uint256 amount, address onBehalfOf) internal {
...
// Transfer reserve assets from the caller (msg.sender) to the reserve
@> IERC20(reserve.reserveAssetAddress).safeTransferFrom(msg.sender, reserve.reserveRTokenAddress, amountScaled);
...
}
​
function finalizeLiquidation(address userAddress) external nonReentrant onlyStabilityPool {
...
// Transfer reserve assets from Stability Pool to cover the debt
@> IERC20(reserve.reserveAssetAddress).safeTransferFrom(msg.sender, reserve.reserveRTokenAddress, amountScaled);
...
}

In _repay() and finalizeLiquidation(), the protocol receives funds(reserve tokens), but these funds will not be deposited to the Curve vault due to lack of _rebalanceLiquidity()calls. Since the Curve vault provides yield, the protocol misses potential interest earnings.

Impact

Protocol will lose interest earnings.

Tools Used

manual

Recommendations

Adds _rebalanceLiquidity()calls in _repay() and finalizeLiquidation()

function _repay(uint256 amount, address onBehalfOf) internal {
...
// Transfer reserve assets from the caller (msg.sender) to the reserve
IERC20(reserve.reserveAssetAddress).safeTransferFrom(msg.sender, reserve.reserveRTokenAddress, amountScaled);
​
+ _rebalanceLiquidity()
...
}
​
function finalizeLiquidation(address userAddress) external nonReentrant onlyStabilityPool {
...
// Transfer reserve assets from Stability Pool to cover the debt
IERC20(reserve.reserveAssetAddress).safeTransferFrom(msg.sender, reserve.reserveRTokenAddress, amountScaled);
​
+ _rebalanceLiquidity()
...
}
Updates

Lead Judging Commences

inallhonesty Lead Judge about 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::finalizeLiquidation or repay doesn't call _rebalanceLiquidity, leaving excess funds idle instead of depositing them in Curve vault for yield

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.