Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect Owner Parameter in `CurveCrvUSDVault::withdraw`

TheKhans

Summary

The owner parameter in CurveCrvUSDVault::withdraw is incorrectly set as msg.sender instead of address(this), preventing withdrawals.

Vulnerability Details

The withdraw function in CurveCrvUSDVault requires the owner parameter to specify the owner of the shares which can be seen from below code.

/contracts/interfaces/curve/ICurveCrvUSDVault.sol:40
48: function withdraw(
49: uint256 assets,
50: address receiver,
51: address owner,
52: uint256 maxLoss,
53: address[] calldata strategies
54: ) external returns (uint256 shares);

However, in LendingPool::_withdrawFromVault, msg.sender is incorrectly passed as the owner of shares:

/contracts/core/pools/LendingPool/LendingPool.sol:888
888: function _withdrawFromVault(uint256 amount) internal {
889: curveVault.withdraw(amount, address(this), msg.sender, 0, new address[](0)); // @audit should be address(this) instead of msg.sender
890: totalVaultDeposits -= amount;
891: }

Since the LendingPool holds the shares as can be seen from the deposit function here, therefor it should pass address(this) instead.

Impact

The LendingPool will fail to withdraw assets from CurveCrvUSDVault.

Tools Used

Manual Review

Recommendations

Replace msg.sender with address(this):

function _withdrawFromVault(uint256 amount) internal {
- curveVault.withdraw(amount, address(this), msg.sender, 0, new address[](0));
+ curveVault.withdraw(amount, address(this), address(this), 0, new address[](0));
totalVaultDeposits -= amount;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_withdrawFromVault incorrectly uses msg.sender instead of address(this) as the owner parameter, causing vault withdrawals to fail

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_withdrawFromVault incorrectly uses msg.sender instead of address(this) as the owner parameter, causing vault withdrawals to fail

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!