Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Incorrect deposit/withdraw implementation with crvUSD Vault

x1485967

Summary

Incorrect deposit/withdraw implementation with crvUSD Vault

Vulnerability Details

In LendingPool, the owner can set one curveVault. When users deposit funds, we will deposit one part of funds into the crvUSD vault to earn some extra profits.

The problem is that we try to deposit the funds from LendingPool contract. But we have already transferred users' deposit funds to rToken contract. If we want to deposit one part of deposit funds into the crvUSD Vault, we should deposit from rToken contract, not the lendingPool contract.

function deposit(ReserveData storage reserve,ReserveRateData storage rateData,uint256 amount,address depositor) internal returns (uint256 amountMinted) {
​
// Transfer asset from caller to the RToken contract
IERC20(reserve.reserveAssetAddress).safeTransferFrom(
msg.sender, // from
reserve.reserveRTokenAddress, // to
amount // amount
);
}
​
function _depositIntoVault(uint256 amount) internal {
IERC20(reserve.reserveAssetAddress).approve(address(curveVault), amount);
curveVault.deposit(amount, address(this));
totalVaultDeposits += amount;
}

Impact

curveVault feature cannot work as expected.

Tools Used

Manual

Recommendations

Deposit the funds from the rToken contract.

Updates

Lead Judging Commences

inallhonesty Lead Judge about 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_depositIntoVault and _withdrawFromVault don't transfer tokens between RToken and LendingPool, breaking Curve vault interactions

inallhonesty Lead Judge about 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_depositIntoVault and _withdrawFromVault don't transfer tokens between RToken and LendingPool, breaking Curve vault interactions

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.