Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Withdrawing from the curve vault will fail due to a wrong input

s4muraii77

Summary

Withdrawing from the curve vault will fail due to a wrong input

Vulnerability Details

Upon operations such as withdrawing, we have the following code, located in _ensureLiquidity():

uint256 availableLiquidity = IERC20(reserve.reserveAssetAddress).balanceOf(reserve.reserveRTokenAddress);
​
if (availableLiquidity < amount) {
uint256 requiredAmount = amount - availableLiquidity;
// Withdraw required amount from the Curve vault
_withdrawFromVault(requiredAmount);
}

If there isn't sufficient liquidity in the RToken contract to satisfy the withdrawal, we will pull the required amount from the curve vault. There, we have the following code:

curveVault.withdraw(amount, address(this), msg.sender, 0, new address[](0));

The issue is that the third input is incorrect, it is msg.sender which is the withdrawer, this requires the msg.sender to provide the vault shares. This is incorrect as the shares are in the lending pool as that is the share receiver upon vault deposits. This will simply revert unless the user does not provide his own shares he has from somewhere else, which would be unfair for him and will simply lead to a loss of funds for him.

Impact

Users will not be able to withdraw despite there being sufficient liquidity

Tools Used

Manual Review

Recommendations

Use address(this) instead

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_withdrawFromVault incorrectly uses msg.sender instead of address(this) as the owner parameter, causing vault withdrawals to fail

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_withdrawFromVault incorrectly uses msg.sender instead of address(this) as the owner parameter, causing vault withdrawals to fail

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.