Core Contracts

Summary

Curve Vault yields cannot be withdrawn and depositors receives no profit.

Vulnerability Details

When user deposits CrvUSD into LendingPool, some of the funds will be depsoited into Curve Vault.

Curve Vault depositor receives vault shares which are yield-bearing and can be redeemed at any time to get back deposit
plus any yield generated.

In LendingPool, the only way to withdraw from Curve Vault is _withdrawFromVault(), which calls Curve vault's withdraw().

LendingPool::_withdrawFromVault():

Curve vault's withdraw() withdraws amount of CrvUSD the caller specified, in LendingPool, _withdrawFromVault() is called by _rebalanceLiquidity() and _ensureLiquidity(), and the withdrawn amount is capped by the the total reserve liquidity.

Assuming the total reserve liquidity is 10000, and 80% of the reserve is deposited into Curve vault (liquidityBufferRatio is 20%). When withdraws, the LendingPool will only withdraws at most 8000 from Curve vault, any generated yields are ignored.

Impact

Yields generated in Curve vault are ignored, depositors will not recevie the profit.

Tools Used

Manual Review

Recommendations

When user withdraws, check the generated yields in Curve vault, redeem and distributes the yields to the user based on their deposited amount.