Core Contracts

Summary

The _withdrawFromVault function in the LendingPool contract incorrectly uses msg.sender as the owner parameter when calling Curve vault's withdraw function. Since the shares are owned by the LendingPool contract (address(this)), using msg.sender as the owner will cause the withdrawal to fail.

Vulnerability Details

The issue occurs because:

1. During deposit, shares are minted to address(this) (LendingPool)

   function _depositIntoVault(uint256 amount) internal {

   IERC20(reserve.reserveAssetAddress).approve(address(curveVault), amount);

   curveVault.deposit(amount, address(this)); // shares are minted into the lending vault

   totalVaultDeposits += amount;

   }

   And as declared in the interface:

   /**

   * @notice Deposits assets into the vault

   * @param assets Amount of assets to deposit

   * @param receiver Address to receive the shares

   * @return shares Amount of shares minted

   */

   function deposit(uint256 assets, address receiver) external returns (uint256 shares);

2. During withdrawal, msg.sender is incorrectly used as the owner parameter

   As declared in the interface, the owner is the Owner of the shares:

   /**

   * @notice Withdraws assets from the vault

   * @param assets Amount of assets to withdraw

   * @param receiver Address to receive the assets

   * @param owner Owner of the shares

   * @param maxLoss Maximum acceptable loss in basis points

   * @param strategies Optional specific strategies to withdraw from

   * @return shares Amount of shares burned

   */

   function withdraw(

   uint256 assets,

   address receiver,

   address owner,

   uint256 maxLoss,

   address[] calldata strategies

   ) external returns (uint256 shares);

3. Curve vault checks ownership of shares against the owner parameter

4. Since msg.sender doesn't own the shares, the withdrawal fails

Impact

1. All withdrawals from Curve vault will fail

2. Protocol cannot access deposited assets

3. User withdrawals and borrowing operations may be blocked

4. Could lead to locked funds in Curve vault

Tools Used

Manual

Recommendations