Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Setting the curveVault would cause most lendingPool transactions to revert

meeve

Summary

LendingPool splits founds between curveVault and reserveRTokenAddress according to liquidityBufferRatio after every balance change. But as soon as vault would be set this would revert all the transactions, because of calling vault in incorrect way.

Vulnerability Details

_rebalanceLiquidity is called to transfer founds between curveVault and reserveRTokenAddress.

// LendingPool.sol 799
​
function _depositIntoVault(uint256 amount) internal {
IERC20(reserve.reserveAssetAddress).approve(address(curveVault), amount);
curveVault.deposit(amount, address(this));
totalVaultDeposits += amount;
}

Firstly it approves amount of tokens to transfer, but the problem is that lendingPool doesn't have any tokens to transfer, since all the tokens are owned by reserve.reserveRTokenAddressas it can be even seen in both _rebalanceLiquidity and _ensureLiquidity.

// LendingPool.sol 754
​
function _ensureLiquidity(uint256 amount) internal
​
...
​
uint256 availableLiquidity = IERC20(reserve.reserveAssetAddress).balanceOf(reserve.reserveRTokenAddress);
...
}

There is not a single moment, when LendingPool should have these tokens. So trying to deposit any amount would revert the transaction.

Withdrawing from the vault will also fail, because msg.sender is not an owner of the shares, address(this) should be send as a third parameter.

// LendingPool.sol 809
​
function _withdrawFromVault(uint256 amount) internal {
curveVault.withdraw(amount, address(this), msg.sender, 0, new address);
totalVaultDeposits -= amount;
}

What is more, these tokens should not be sent to LendingPool, but to the reserveRTokenAddress. The purpose of calling this function is to prepare liquidity for withdrawing or borrowing, and assets for these operations are beeing transfered from the reserveRTokenAddress.

Impact

As soon as vault would be set, all borrows, withdraws and deposits will be reverted.

Tools Used

Manual Review

Recommendations

Vault deposits and withdrawals should be corrected.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_depositIntoVault and _withdrawFromVault don't transfer tokens between RToken and LendingPool, breaking Curve vault interactions

LendingPool::_withdrawFromVault incorrectly uses msg.sender instead of address(this) as the owner parameter, causing vault withdrawals to fail

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_depositIntoVault and _withdrawFromVault don't transfer tokens between RToken and LendingPool, breaking Curve vault interactions

LendingPool::_withdrawFromVault incorrectly uses msg.sender instead of address(this) as the owner parameter, causing vault withdrawals to fail

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!