Summary

The _depositIntoVault and _withdrawFromVault functions in the LendingPool contract are responsible for managing liquidity between the RToken contract and the Curve vault. However, these functions do not properly rebalance funds between the RToken contract and the vault. Specifically, when depositing into the vault, funds should be withdrawn from the RToken contract, and when withdrawing from the vault, funds should be deposited back into the RToken contract.

Vulnerability Details

The _depositIntoVault function deposits funds into the Curve vault but does not withdraw the corresponding amount from the RToken contract.

https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/pools/LendingPool/LendingPool.sol#L799

https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/pools/LendingPool/LendingPool.sol#L809

Similarly, the _withdrawFromVault function withdraws funds from the Curve vault but does not deposit the corresponding amount back into the RToken contract.

The LendingPool contract don't hold the asset.

Impact

• Liquidity Imbalance: The lack of rebalancing will lead to an imbalance between the RToken contract and the vault, causing liquidity issues.

Tools Used

• Manual code review

Recommendations

Rebalance Funds During Deposit and Withdrawal: Modify the _depositIntoVault and _withdrawFromVault functions to ensure proper rebalancing between the RToken contract and the vault.

```solidity
function _depositIntoVault(uint256 amount) internal {
    // Withdraw funds from RToken before depositing into the vault
    IERC20(reserve.reserveAssetAddress).transferFrom(reserve.reserveRTokenAddress, address(this), amount);
    IERC20(reserve.reserveAssetAddress).approve(address(curveVault), amount);
    curveVault.deposit(amount, address(this));
    totalVaultDeposits += amount;
}

function _withdrawFromVault(uint256 amount) internal {
    curveVault.withdraw(amount, address(this), msg.sender, 0, new address[](0));
    // Deposit funds back to RToken after withdrawing from the vault
    IERC20(reserve.reserveAssetAddress).transfer(reserve.reserveRTokenAddress, amount);
    totalVaultDeposits -= amount;
}
```