Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Depositing to the curve vault will always fail as we are sending out tokens we don't have

s4muraii77

Summary

Depositing to the curve vault will always fail as we are sending out tokens we don't have

Vulnerability Details

The flow for supplying into the LendingPool involves transferring the asset of the pool (crvUSD), sending it to RToken and then getting minted RToken shares. After that, upon rebalancing the liquidity, we have this piece of code:

uint256 currentBuffer = IERC20(reserve.reserveAssetAddress).balanceOf(reserve.reserveRTokenAddress);
​
if (currentBuffer > desiredBuffer) {
uint256 excess = currentBuffer - desiredBuffer;
_depositIntoVault(excess);
}

We are depositing the excess of the asset into the curve vault:

function _depositIntoVault(uint256 amount) internal {
IERC20(reserve.reserveAssetAddress).approve(address(curveVault), amount);
curveVault.deposit(amount, address(this));
totalVaultDeposits += amount;
}

However, as seen above, we approve the curve vault for the amount and then call deposit() for it. This will simply revert as the crvUSD were sent to the RToken contract and we do not have access to them.

Impact

Rebalancing will be impossible, this will lead to a DOS of many functionalities when a deposit into the vault must happen

Tools Used

Manual Review

Recommendations

Implement a function on RToken to pull the tokens and then approve + deposit

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_depositIntoVault and _withdrawFromVault don't transfer tokens between RToken and LendingPool, breaking Curve vault interactions

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_depositIntoVault and _withdrawFromVault don't transfer tokens between RToken and LendingPool, breaking Curve vault interactions

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.