Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

`LendingPool::setCurveVault` allows owner to update the vault without checking if there is any amount deposited

77SecMentees

Summary

LendingPool::setCurveVaultcan be called by the owner to update the curveVault that will receive the values from rebalance transactions.

Vulnerability Details

The owner can update the vault address without manually checking totalVaultDeposits the variable, it will temporarily lock funds away until it is updated again. If a new address is added and also receives deposits, the liquidity would be split through different pool addresses.

function setCurveVault(address newVault) external onlyOwner {
require(newVault != address(0), "Invalid vault address");
address oldVault = address(curveVault);
curveVault = ICurveCrvUSDVault(newVault);
emit CurveVaultUpdated(oldVault, newVault);
}

Impact

Withdrawals will be temporarily halted, resulting in a denial of service for withdrawal functions. If this issue is identified after a delay, the situation can worsen, potentially fragmenting the protocol's liquidity across various vaults.

Tools Used

Code Review

Recommendations

function setCurveVault(address newVault) external onlyOwner {
+ if(totalVaultDeposits > 0) revert();
require(newVault != address(0), "Invalid vault address");
address oldVault = address(curveVault);
curveVault = ICurveCrvUSDVault(newVault);
emit CurveVaultUpdated(oldVault, newVault);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::setCurveVault doesn't withdraw funds from old vault before changing address, permanently locking deposited assets

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::setCurveVault doesn't withdraw funds from old vault before changing address, permanently locking deposited assets

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!