Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Incorrect Asset Withdrawal Destination in `LendingPool.borrow()`

gajiknownnothing

Summary

The LendingPool.borrow() function ensures sufficient liquidity by withdrawing assets from the Curve vault using _withdrawFromVault(). However, the withdrawn assets are sent to the LendingPool contract instead of the RToken contract. Since the borrow() function attempts to transfer assets from the RToken contract to the borrower, this mismatch causes the borrow operation to fail due to insufficient balance in the RToken contract.

Vulnerability Details

The _withdrawFromVault() function withdraws assets from the Curve vault to the LendingPool contract. However, the borrow() function attempts to transfer assets from the RToken contract to the borrower. Since the assets are not sent to the RToken contract, the transferAsset() call fails due to insufficient balance.

LendingPool::_withdrawFromVault()

function _withdrawFromVault(uint256 amount) internal {
curveVault.withdraw(amount, address(this), msg.sender, 0, new address[](0));
totalVaultDeposits -= amount;
}

LendingPool::borrow()

// Transfer borrowed amount to user
IRToken(reserve.reserveRTokenAddress).transferAsset(msg.sender, amount);

RToken::transferAsset()

function transferAsset(address user, uint256 amount) external override onlyReservePool {
IERC20(_assetAddress).safeTransfer(user, amount);
}

Impact

Borrow operations will fail, preventing users from accessing liquidity.

Tools Used

vscode

Recommendations

Modify the _withdrawFromVault() function to withdraw assets directly to the RToken contract instead of the LendingPool contract.

Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_depositIntoVault and _withdrawFromVault don't transfer tokens between RToken and LendingPool, breaking Curve vault interactions

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_depositIntoVault and _withdrawFromVault don't transfer tokens between RToken and LendingPool, breaking Curve vault interactions

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.