Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Withdrawing additional assets for borrows does not work

OpaBatyo

Summary

If a user wants to borrow tokens and there isn't enough liquidity to cover the borrow, the LendingPool will attempt to withdraw liquidity from the Vault but it withdraws it to the wrong address.

Vulnerability Details

If a user wants to borrow tokens from the LendingPool, the _ensureLiquidity() function is called to make sure there is enough liquidity for the borrow:

function _ensureLiquidity(uint256 amount) internal {
// if curve vault is not set, do nothing
if (address(curveVault) == address(0)) {
return;
}
​
uint256 availableLiquidity = IERC20(reserve.reserveAssetAddress).balanceOf(reserve.reserveRTokenAddress);
​
if (availableLiquidity < amount) {
uint256 requiredAmount = amount - availableLiquidity;
// Withdraw required amount from the Curve vault
_withdrawFromVault(requiredAmount);
}
}

If the borrow amount is more than the available liquidity, it will withdraw the difference from the vault. The liquidity in the protocol in general, is in the reserveRTokenAddress (the function also checks the available liquidity in that address), since when users deposit, their tokens are transferred there as well.

The issue is that the _withdrawFromVault function actually withdraws the tokens to address(this) which is the LendingPool:

function _withdrawFromVault(uint256 amount) internal {
curveVault.withdraw(amount, address(this), msg.sender, 0, new address[](0));
totalVaultDeposits -= amount;
}

Essentially making the whole request for liquidity pointless. Later in the borrow function flow it will still revert due to missing liquidity since it will try to pull it from the reserveRTokenAddress, but the new liquidity was transferred into the LendingPool instead.

Impact

If there isn't enough liquidity for a borrow, the intended function to pull more liquidity will not work and users will still be unable to borrow.

Tools Used

Manual Review

Recommendations

Withdraw the vault tokens into the reserveRTokenAddress instead of the LendingPool.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_depositIntoVault and _withdrawFromVault don't transfer tokens between RToken and LendingPool, breaking Curve vault interactions

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_depositIntoVault and _withdrawFromVault don't transfer tokens between RToken and LendingPool, breaking Curve vault interactions

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!