Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

_rebalanceLiquidity() missed in repay() and repayOnBehalf()

zhanmingjing

Summary

_rebalanceLiquidity() missed in repay() and repayOnBehalf()

Vulnerability Details

_rebalanceLiquidity() is used to rebalances liquidity between the buffer and the Curve vault to maintain the desired buffer ratio. This function is called in deposit() and withdraw(), but missed in repay() and repayOnBehalf().

After repay() and repayOnBehalf(), 'IERC20(reserve.reserveAssetAddress).balanceOf(reserve.reserveRTokenAddress)' will be changed, refer to LendingPool.sol#Line422:

// Transfer reserve assets from the caller (msg.sender) to the reserve
IERC20(reserve.reserveAssetAddress).safeTransferFrom(msg.sender, reserve.reserveRTokenAddress, amountScaled);

The change may make liquidity between the buffer and the Curve vault out of the desired buffer ratio.

Impact

after repay() and repayOnBehalf(), liquidity between the buffer and the Curve vault may not be in the the desired buffer ratio

Tools Used

manually reviewed

Recommendations

add '_rebalanceLiquidity()' at the end of function _repay()

function _repay(uint256 amount, address onBehalfOf) internal {
...
// Transfer reserve assets from the caller (msg.sender) to the reserve
IERC20(reserve.reserveAssetAddress).safeTransferFrom(msg.sender, reserve.reserveRTokenAddress, amountScaled);
reserve.totalUsage = newTotalSupply;
user.scaledDebtBalance -= amountBurned;
// Update liquidity and interest rates
ReserveLibrary.updateInterestRatesAndLiquidity(reserve, rateData, amountScaled, 0);
​
//added
_rebalanceLiquidity();
emit Repay(msg.sender, onBehalfOf, actualRepayAmount);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::finalizeLiquidation or repay doesn't call _rebalanceLiquidity, leaving excess funds idle instead of depositing them in Curve vault for yield

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.