In LendingPool, users deposit crvUSD, with a buffer liquidityBufferRatio
kept on the LendingPool contract, and the rest is staked in the curveVault
The issue is that there is no mechanism to transfer the liquidity held in oldCurveVault to NewCurveVault in case of an update from Curve.fi
Calling setCurveVault
will change the address of the storage curveVault
but will not transfer previous funds held in oldVault to the newVault.
All accounting will be messed up and previous liquidity will be stuck in the oldVault.
Changing curveVault
will mess up all the accountability of the LendingPool, and totalDeposits - liquidityBufferRatio
will be stuck in the older vault. User will not be able to withdraw()
their crvUSD as there will not be enough liquidity for everyone.
Manual
Remove all liquidity from the previous vault when updating the address, and then rebalance to add the liquidity back to the new vault.
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.