Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Protocol goes completely broken if the `curveVault` is changed in `LendingPool`

kirobrejka

Summary

Protocol goes completely broken if the curveVault is changed in LendingPool. This is due to the absence of withdrawing the funds from the old vault and depositing it to the new one as seen here:

function setCurveVault(address newVault) external onlyOwner {
require(newVault != address(0), "Invalid vault address");
address oldVault = address(curveVault);
curveVault = ICurveCrvUSDVault(newVault);
emit CurveVaultUpdated(oldVault, newVault);
}
​

Vulnerability Details

When the setCurveVault is called the vault is changed, but the funds from there are never withdrawn and deposited to the other vault. Imagine the following scenario:

  1. The owner sets a vault and some time passes. during this time some crvUSD is deposited in exchange for vault shares

  2. Then a new, better vault appears and the owner changes the vault, which doesn't withdraw the assets from the old vault to deposit it to the new one

  3. This leads to DoS for the whole LendingPool and impossibility for liquidity providers to withdraw their assets and impossibility for users to borrow funds

After this the owner can't even go back to the old vault because at this moment in time some other users may deposited in the system and their funds may be deposited to the vault.
Overall this means a big loss of funds for the protocol and for the its users

Impact

This means a big loss of funds for the protocol and for the its users, because not every user will be able to withdraw

Tools Used

Manual Review

Recommendations

When changing the vault withdraw the funds from the old vault and deposit to the new one

Updates

Lead Judging Commences

inallhonesty Lead Judge about 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::setCurveVault doesn't withdraw funds from old vault before changing address, permanently locking deposited assets

inallhonesty Lead Judge about 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::setCurveVault doesn't withdraw funds from old vault before changing address, permanently locking deposited assets

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.