Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

No token can be withdraw from the curve vault

0xphantom

Summary

If the lending pool withdraw from the curve vault the call will always revert because the lending pool withdraw the tokens of the msg.sender and not the tokens of the lending pool.

Vulnerability Details

the function _rebalanceLiquidity L-789 withdraw from the vault if the current buffer is smaller than the desired buffer.

uint256 totalDeposits = reserve.totalLiquidity; // Total liquidity in the system
uint256 desiredBuffer = totalDeposits.percentMul(liquidityBufferRatio);
uint256 currentBuffer = IERC20(reserve.reserveAssetAddress).balanceOf(reserve.reserveRTokenAddress);
​
if (currentBuffer > desiredBuffer) {
uint256 excess = currentBuffer - desiredBuffer;
// Deposit excess into the Curve vault
_depositIntoVault(excess);
} else if (currentBuffer < desiredBuffer) {
uint256 shortage = desiredBuffer - currentBuffer;
// Withdraw shortage from the Curve vault
_withdrawFromVault(shortage);
}

The call will revert because the argument used as owner is the msg.sender not the lending pool moreover the beneficiary is set as the lending pool but it should be the Rtoken address since it serves as reserve.

We can see here in the CrvUSDVault interface

function withdraw(
uint256 assets,
address receiver,
address owner,
uint256 maxLoss,
address[] calldata strategies
) external returns (uint256 shares);

and here from the function _withdrawFromVault L-809

function _withdrawFromVault(uint256 amount) internal {
curveVault.withdraw(amount, address(this), msg.sender, 0, new address[](0));
totalVaultDeposits -= amount;
}

Impact

The call will revert since the lending pool should be the owner.

Tools Used

manual review

Recommendations

Change the function _withdrawFromVault to withdraw from the lending pool.

curveVault.withdraw(amount, reserve.reserveRTokenAddress, address(this), 0, new address[](0));
Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_withdrawFromVault incorrectly uses msg.sender instead of address(this) as the owner parameter, causing vault withdrawals to fail

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_withdrawFromVault incorrectly uses msg.sender instead of address(this) as the owner parameter, causing vault withdrawals to fail

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.