Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

`LendingPool::_withdrawFromVault` expects shares to be burned from `msg.sender`; crvUsd will be locked in scrvUsd vault

alexczm

Summary

LendingPool::_withdrawFromVault can't withdraw from scrvUsd Vault because vault.withdraw is called with owner == msg.sender; msg.sender doesn't hold vault's share.

Vulnerability Details

LendingPool integrates scrvVault for additional interest for LP.
The lending pool is rebalanced on each deposit/withdraw/borrow and liquidity is deposited or withdrawed from scrvUsdVault as required.

On deposit to vault shares are issued to LendingPool

function _depositIntoVault(uint256 amount) internal {
IERC20(reserve.reserveAssetAddress).approve(address(curveVault), amount);
@> curveVault.deposit(amount, address(this));
totalVaultDeposits += amount;
}

In _withdrawFromVault, msg.sender is passed as the owner of the shares to be burned.

function _withdrawFromVault(uint256 amount) internal {
curveVault.withdraw(amount, address(this), msg.sender, 0, new address[](0));//@audit passign msg.sender as 'owner' of shares
totalVaultDeposits -= amount;
}

msg.sender in this case is the user who withdraw/ borrow from the LendingPool, he holds no scrvUsd vault shares. msg.sender is eronously passed to withdraw as the owner of the shares. Lending pool is unable to withdraw from scrvUsd vault.

Impact

Funds sent to scrvUsd vault are permanently locked.

Tools Used

Recommendations

Pass address(this) as the owner of shares to be burned.

function _withdrawFromVault(uint256 amount) internal {
- curveVault.withdraw(amount, address(this), msg.sender, 0, new address[](0));
+ curveVault.approve(address(curveVault), amount);
+ curveVault.withdraw(amount, address(this), address(this) 0, new address[](0));
totalVaultDeposits -= amount;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_withdrawFromVault incorrectly uses msg.sender instead of address(this) as the owner parameter, causing vault withdrawals to fail

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_withdrawFromVault incorrectly uses msg.sender instead of address(this) as the owner parameter, causing vault withdrawals to fail

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.