Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Missing RToken#rescueToken() call in LendingPool

newspacexyz

Summary

RToken#rescueToken() is not called in LendingPool. Thus this function is disabled.

Vulnerability Details

The RToken contract includes a rescueToken() function designed to recover mistakenly sent ERC20 tokens. However, this function is never called within LendingPool, making it inaccessible from the primary protocol contract.

  • Since only the Reserve Pool (LendingPool) can invoke rescueToken(), failing to provide an interface in LendingPool means there is no way to trigger token recovery.

  • If tokens are mistakenly sent to RToken, they become permanently stuck.

Impact

Function disabled and mistaken tokens sent will be stuck permanently.

Tools Used

manual

Recommendations

Add a rescueTokenFromRToken() Function in LendingPool That Calls RToken#rescueToken()

function rescueTokenFromRToken(address tokenAddress, address recipient, uint256 amount) external onlyOwner {
rToken.rescueToken(tokenAddress, recipient, amount);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RToken::rescueToken() can never be called

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.