Improper fixed maxloss in _withdrawFromVault
In LendingPool::_withdrawFromVault(), we will withdraw funds from the crvUSD Vault. In this function curveVault.withdraw()
, the fourth parameter is one fixed value, 0, it means that the max_loss bps. It means that we do not accept any loss from the crvUSD Vault.
In scrvUSDVault, the deposited funds will be deposited into strategies. In most cases, depositors do not need to take the loss. But if there is something wrong in the strategy, depositors have to take some loss. Because we set the max_loss to 0, it will cause our withdraw transaction will always be reverted.
The withdraw transaction will always be reverted if there is some loss in the crvUSD vault.
Manual
Add one max_loss variable in the lending pool. The owner can set the variable according to the crvUSD vault's condition.
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.