Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Missing `_rebalanceLiquidity` in `finalizeLiquidation` and `_repay` call in `LendingPool`

TheKhans

Summary

The _rebalanceLiquidity function is called at the end of deposit, withdraw, and borrow, but it is missing in finalizeLiquidation and _repay, which disrupt liquidity management.

Vulnerability Details

_rebalanceLiquidity is invoked at the end of deposit, withdraw, and borrow operations:

/contracts/core/pools/LendingPool/LendingPool.sol:240
240: // Rebalance liquidity after deposit
241: _rebalanceLiquidity();
/contracts/core/pools/LendingPool/LendingPool.sol:267
267: // Rebalance liquidity after withdrawal
268: _rebalanceLiquidity();
/contracts/core/pools/LendingPool/LendingPool.sol:393
393: // Rebalance liquidity after borrowing
394: _rebalanceLiquidity();

This function ensures proper liquidity allocation by depositing excess assets into curveVault or withdrawing if needed:

/contracts/core/pools/LendingPool/LendingPool.sol:827
827: if (currentBuffer > desiredBuffer) {
828: uint256 excess = currentBuffer - desiredBuffer;
829: // Deposit excess into the Curve vault
830: _depositIntoVault(excess);
831: } else if (currentBuffer < desiredBuffer) {
832: uint256 shortage = desiredBuffer - currentBuffer;
833: // Withdraw shortage from the Curve vault
834: _withdrawFromVault(shortage);
835: }

However, finalizeLiquidation and _repay does not call _rebalanceLiquidity, potentially leading to imbalanced liquidity.

Impact

the LendingPool will not respect the allowed buffer assets in RTokenAddress and will hold more token than required. Which is not intended and result in lose of yield for protocol.

Tools Used

Manual Review

Recommendations

Add _rebalanceLiquidity in finalizeLiquidation and _repay to maintain proper liquidity distribution.

/contracts/core/pools/LendingPool/LendingPool.sol:568
+ _rebalanceLiquidity();
emit LiquidationFinalized(stabilityPool, userAddress, userDebt, getUserCollateralValue(userAddress));
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::finalizeLiquidation or repay doesn't call _rebalanceLiquidity, leaving excess funds idle instead of depositing them in Curve vault for yield

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!