The `repay` and `finalizeLiquidation` functions does not rebalance liquidity
Summary
The repay and finalizeLiquidation functions in LendingPool contract do not rebalance liquidity after that assets are transferred into the lending pool
Vulnerability Details
The LendingPool has a rebalance liquidity feature that rebalances liquidity between the buffer and the Curve vault to maintain the desired buffer ratio.
When a user deposit -> the liquidity is rebalanced after transferring assets
When a user withdraws -> Ensure sufficient liquidity is available Before assets are transferred and rebalance liquidity after withdrawal
When a user borrows -> Ensure sufficient liquidity is available Before assets are transferred and rebalance liquidity after borrowing
When a user repays -> fails to rebalance liquidity after transferring assets
When liquidation occurs -> fails to rebalance liquidity after transferring assets
Impact
The liquidity is not rebalanced, the crvUSDC deposited within the repay or finalizeLiquidation functions will remain in the Lending pool contract, and the pool may have more than the desired buffer into the contract which is not optimal
Tools Used
Manual Review
Recommendations
Add this after _repay and finalizeLiquidation function
Lead Judging Commences
LendingPool::finalizeLiquidation or repay doesn't call _rebalanceLiquidity, leaving excess funds idle instead of depositing them in Curve vault for yield
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.