Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect Ownership Handling in `_withdrawFromVault` Function

federodes

Summary

The _withdrawFromVault function attempts to withdraw assets from the curveVault. However, the owner parameter in the curveVault::withdraw function is incorrectly set to msg.sender rather than the LendingPool contract (address(this)), which owns the shares after the initial deposit. This leads to a transaction failure, preventing the liquidity from being properly rebalanced between the curveVault and the reserveRToken contract.

Vulnerability Details

In the _withdrawFromVault function, the third parameter of curveVault::withdraw is incorrectly set to msg.sender, whereas it should be set to the LendingPool contract (address(this)), which holds the shares after depositing assets into the vault. This misalignment causes the transaction to fail during the withdrawal.

function _withdrawFromVault(uint256 amount) internal {
@> curveVault.withdraw(amount, address(this), msg.sender, 0, new address
// @audit-issue The third parameter (`owner`) should be set to `address(this)` (the `LendingPool` contract) because it is the actual owner of the shares, not `msg.sender`.
totalVaultDeposits -= amount;
}
function _depositIntoVault(uint256 amount) internal {
IERC20(reserve.reserveAssetAddress).approve(address(curveVault), amount);
@> curveVault.deposit(amount, address(this));
// @audit-notice When assets are deposited into the `curveVault`, the `LendingPool` contract (`address(this)`) receives the shares and becomes the owner of them. These shares are then burned during the withdrawal process.
totalVaultDeposits += amount;
}

Impact

DoS of the deposit and withdraw functions due to _rebalanceLiquidity will always fail

Tools Used

Manual review

Recommendations

Modify the owner parameter in the curveVault::withdraw function call to use address(this) (the LendingPool contract) instead of msg.sender:

function _withdrawFromVault(uint256 amount) internal {
- curveVault.withdraw(amount, address(this), msg.sender, 0, new address );
+ curveVault.withdraw(amount, address(this), address(this), 0, new address );
totalVaultDeposits -= amount;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_withdrawFromVault incorrectly uses msg.sender instead of address(this) as the owner parameter, causing vault withdrawals to fail

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_withdrawFromVault incorrectly uses msg.sender instead of address(this) as the owner parameter, causing vault withdrawals to fail

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.