Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Withdraw from the curve vault will get failed.

nikhil20

Summary

As ensureLiquidity function balance the asset amount and maintains the 20:80 ratio. But the _withdrawFromVault function is implemented incorrectly which will lead to failure to withdraw funds from the curve vault and funds will get locked.

Vulnerability Details

If we take a look at the function LendingPool::_withdrawFromVault , the withdraw function of curve vault is called with the following parameter, the address(this) is the receiver and msg.sender is the owner of the shares, with respect to the withdraw function of curve

function _withdrawFromVault(uint256 amount) internal {
curveVault.withdraw(amount, address(this), msg.sender, 0, new address[](0));
totalVaultDeposits -= amount;
}

While if we look at the snippet where the funds are getting deposited to the curve vault there the owner is passed as the LendingPool(address(this),

function _depositIntoVault(uint256 amount) internal {
IERC20(reserve.reserveAssetAddress).approve(address(curveVault), amount);
curveVault.deposit(amount, address(this));
totalVaultDeposits += amount;
}
​

Hence the owner of those shares will be LendingPool, not the user who has deposited the funds, hence the withdraw will get failed.

Impact

Withdraw of tokens will not be don

Tools Used

Manual Review

Recommendations

Use LendingPool as the owner then withdraw those assets from curved vault.

Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_withdrawFromVault incorrectly uses msg.sender instead of address(this) as the owner parameter, causing vault withdrawals to fail

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_withdrawFromVault incorrectly uses msg.sender instead of address(this) as the owner parameter, causing vault withdrawals to fail

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.