Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Incorrect Recipient in Curve Vault Withdrawals

otor

Summary

The _withdrawFromVault function in the LendingPool contract incorrectly sets the recipient as address(this) (LendingPool) instead of reserve.reserveRTokenAddress (RToken contract) when withdrawing from the Curve vault. This misalignment breaks the protocol's asset flow since RToken is meant to be the holder of the reserve assets.

Vulnerability Details

// Current implementation - Incorrect recipient
function _withdrawFromVault(uint256 amount) internal {
curveVault.withdraw(
amount,
address(this), // Incorrect: Assets sent to LendingPool
address(this),
0,
new address[](0)
);
totalVaultDeposits -= amount;
}

The issue occurs because:

  1. Protocol design requires reserve assets to be held by RToken contract

  2. Current implementation sends assets to LendingPool instead

  3. This breaks the expected asset flow and accounting

Impact

  1. Assets are sent to wrong contract address

  2. Breaks protocol's asset management flow

  3. Could lead to accounting errors

  4. May affect user withdrawals and protocol operations

Tools Used

Recommendations

function _withdrawFromVault(uint256 amount) internal {
curveVault.withdraw(
amount,
reserve.reserveRTokenAddress, // Correct: Assets sent to RToken
address(this), // Owner remains LendingPool
0,
new address[](0)
);
totalVaultDeposits -= amount;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_depositIntoVault and _withdrawFromVault don't transfer tokens between RToken and LendingPool, breaking Curve vault interactions

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_depositIntoVault and _withdrawFromVault don't transfer tokens between RToken and LendingPool, breaking Curve vault interactions

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!