Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

`_depositIntoVault` will revert if deposit limit is reached

yaioxy

Summary

The curve Vault has a deposit limit, and LendingPool attempts to deposit excess tokens into the curve vault, if this limit is reached, the deposit, withdraw, and borrow functions will revert

Vulnerability Details

The LendingPool contract attempts to rebalance liquidity in deposit, withdraw, and borrow functions, and lets only a desired buffer into the pool, all the excess are deposited into the curve vault

function _rebalanceLiquidity() internal {
// if curve vault is not set, do nothing
if (address(curveVault) == address(0)) {
return;
}
​
uint256 totalDeposits = reserve.totalLiquidity; // Total liquidity in the system
uint256 desiredBuffer = totalDeposits.percentMul(liquidityBufferRatio);
uint256 currentBuffer = IERC20(reserve.reserveAssetAddress).balanceOf(reserve.reserveRTokenAddress);
​
if (currentBuffer > desiredBuffer) {
uint256 excess = currentBuffer - desiredBuffer;
// Deposit excess into the Curve vault
@> _depositIntoVault(excess);
} else if (currentBuffer < desiredBuffer) {
uint256 shortage = desiredBuffer - currentBuffer;
// Withdraw shortage from the Curve vault
_withdrawFromVault(shortage);
}
​
emit LiquidityRebalanced(currentBuffer, totalVaultDeposits);
}

But the curve vault has a deposit limit check, if this limit is reached, the function will revert

Impact

When a user calls deposit, withdraw, or borrow function, and the excess of tokens will be deposited into the curve vault, but the deposit limit is reached, their call will revert

Tools Used

Manual Review

Recommendations

Before depositing into the curve vault, check if the deposit limit will be reached to avoid a revert

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool core operations revert if Curve vault is unavailable during rebalancing, even when sufficient liquidity exists in the pool

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool core operations revert if Curve vault is unavailable during rebalancing, even when sufficient liquidity exists in the pool

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.