Core Contracts

Summary

Lending pool have the ability to rebalance the liquidity if there are excess or shortage from the desired buffer.

but the logic _withdrawFromVaultdoes not check the value totalVaultDeposits, making the function potentially withdrawing non-existent balance from the vault.

Vulnerability Details

LendingPool.sol#L772-L793

the function _rebalanceLiquidityonly calculate the current buffer and the desired buffer and check the discrepancy between them. if there are so many borrower then it is possible the currentBuffer is lower than the desired buffer. making this function always withdraw from the curve vault on each call.

the problem arise when the shortage amount that would be withdrawed is greater than what the actual deposit left in the curve vault.

because there are no check of the contract balance inside the vault, the function call always assume the contract have enough balance to withdraw, which is not.

LendingPool.sol#L809-L812

Impact

the function would revert after so many withdraw from vault done, because the amount withdrawed is greater than the current contract balance inside the curve vault. this would lead to DoS the LendingPool deposit, withdraw and repay function.

Tools Used

manual review

Recommendations

use the totalVaultDepositsto track and check if the withdrawing amount is enough before doing the curveVault.withdraw, so when it is not enough it is handled by return without throwing error. or better, it should be adjusted to whatever contract balance left in the curve vault.