Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

`LendingPool` can't deposit assets in the `curveVault`

kirobrejka

Summary

LendingPool can't deposit assets in the curveVault. This is due to the absence of reserveAssetAddress supply in the LendingPool

Vulnerability Details

The only possibility for depositing into the curveVault is through the _rebalanceLiquidity function being called. By taking a look into the _rebalanceLiquidity function, we see the following block of code:

function _rebalanceLiquidity() internal {
// if curve vault is not set, do nothing
if (address(curveVault) == address(0)) {
return;
}
​
uint256 totalDeposits = reserve.totalLiquidity; // Total liquidity in the system
uint256 desiredBuffer = totalDeposits.percentMul(liquidityBufferRatio);
@> uint256 currentBuffer = IERC20(reserve.reserveAssetAddress).balanceOf(
reserve.reserveRTokenAddress
);
​
if (currentBuffer > desiredBuffer) {
uint256 excess = currentBuffer - desiredBuffer;
// Deposit excess into the Curve vault
_depositIntoVault(excess);
} else if (currentBuffer < desiredBuffer) {
uint256 shortage = desiredBuffer - currentBuffer;
// Withdraw shortage from the Curve vault
_withdrawFromVault(shortage);
}
​
emit LiquidityRebalanced(currentBuffer, totalVaultDeposits);
}

As seen in the highlighted line, we get the reserveAssetAddress supply of the rToken address. The is nothing wrong with that but when we try to deposit in the vault, it will always revert because the LendingPool doesn't have reserveAssetAddress balance on its own, leading to DoS for the LendingPool::deposit function

Impact

If the vault is set, it will eventually lead to DoS for the deposit function

Tools Used

Manual review

Recommendations

right before calling the _depositIntoVault function, transfer funds from the rToken address to the LendingPool, useing the rToken::transferAssets function, like this:

if (currentBuffer > desiredBuffer) {
uint256 excess = currentBuffer - desiredBuffer;
// Deposit excess into the Curve vault
++ IRToken(reserve.reserveRTokenAddress).transferAsset(address(this), excess);
_depositIntoVault(excess);
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_depositIntoVault and _withdrawFromVault don't transfer tokens between RToken and LendingPool, breaking Curve vault interactions

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_depositIntoVault and _withdrawFromVault don't transfer tokens between RToken and LendingPool, breaking Curve vault interactions

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.