Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Depositing in curve through `LendingPool::_rebalanceLiquidity` won't work as user funds are deposited into `RToken`

056Security

Summary

Users can deposit into the LendingPool to provide liquidity and receive RTokens. The problem arises in the deposit() function of the LendingPool. Whenever the current buffer in the LendingPool exceeds the desired level, the LendingPool transfers the excess tokens to the crvPool. However, this transfer cannot occur, as it tries to deposit from the pool to the vault, however, the user-deposited funds are transferred to the RToken and do not stay in the LendingPool.

Vulnerability Details

Whenever a user deposits in LendingPool, the pool will transfer all incoming funds to the RToken:

function deposit(ReserveData storage reserve,ReserveRateData storage rateData,uint256 amount,address depositor) internal returns (uint256 amountMinted) {
if (amount < 1) revert InvalidAmount();
​
// Update reserve interests
updateReserveInterests(reserve, rateData);
​
// Transfer asset from caller to the RToken contract
IERC20(reserve.reserveAssetAddress).safeTransferFrom(
msg.sender, // from
reserve.reserveRTokenAddress, // to
amount // amount
);
​
__SNIP__
}

After that, before finishing the deposit transaction, the pool will check how much funds are in the RToken, compare them to a set buffer, and deposit any excess funds in a curve vault. However, when depositing to curve, it will try to transfer the funds directly from the pool, instead of the RToken, leading to a DoS of the deposit function.

https://github.com/Cyfrin/2025-02-raac/blob/main/contracts/core/pools/LendingPool/LendingPool.sol#L772-L803

function _depositIntoVault(uint256 amount) internal {
IERC20(reserve.reserveAssetAddress).approve(address(curveVault), amount);
@> curveVault.deposit(amount, address(this)); // @audit - will try to deposit funds from the pool
totalVaultDeposits += amount;
}

Impact

Once the buffer is reached it will result in permanent DoS of the LendingPool::deposit() function.

Tools Used

Manual review

Recommendations

Before depositing to the curve vault, transfer crvUSD from the RToken to the LendingPool.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_depositIntoVault and _withdrawFromVault don't transfer tokens between RToken and LendingPool, breaking Curve vault interactions

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_depositIntoVault and _withdrawFromVault don't transfer tokens between RToken and LendingPool, breaking Curve vault interactions

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!