Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

scrvUSD interest will fail to withdraw

x1485967

Summary

scrvUSD interest will fail to withdraw

Vulnerability Details

In LendingPool, the owner can set crvUSD Vault. Then we will deposit one part of funds into the scrvUSD Vault. The funds we deposit into the scrvUSD Vault can gain some interest for us. So when we deposit funds into the scrvUSD Vault, we can get another part of profit. This profit can be distributed to the depositors or the owner.

Below is one description from s-crvUSD Vault website

Savings crvUSD, abbreviated as scrvUSD, is an interest-bearing stablecoin that earns yield simply by holding the token. Users do not need to take any action whatsoever, as the yield is passively accrued.

The problem is that we record deposit amount in totalVaultDeposits. And when we withdraw from the crvUSD Vault, we will deduct the withdraw amount from totalVaultDeposits. This means that we cannot withdraw more funds than what we deposit into the crvUSD Vault. Then all profit from scrvUSD Vault will be locked in the scrvUSD, and we cannot withdraw this part profit.

Once we withdraw more funds than deposited amount, the transaction will be reverted because of the underflow in the calculation of totalVaultDeposits.

function _depositIntoVault(uint256 amount) internal {
IERC20(reserve.reserveAssetAddress).approve(address(curveVault), amount);
curveVault.deposit(amount, address(this));
totalVaultDeposits += amount;
}
function _withdrawFromVault(uint256 amount) internal {
curveVault.withdraw(amount, address(this), msg.sender, 0, new address[](0));
totalVaultDeposits -= amount;
}

Impact

Profits from scrvUSD will be locked in the scrvUSD, we cannot withdraw this part of profit.

Tools Used

Manual

Recommendations

scrvUSD is one ERC4626 Vault, we can record the share amount that belongs to the protocol.

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool earns yield from Curve Vault deposits but lacks systematic distribution mechanism, leading to protocol-owned value with unclear extraction path

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool earns yield from Curve Vault deposits but lacks systematic distribution mechanism, leading to protocol-owned value with unclear extraction path

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.