Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Incorrect deposit function in ReserveLibrary.sol

shipkata494

Summary

The deposit function in the smart contract is responsible for handling deposits into a reserve, updating interest rates, and minting RTokens to the depositor. However, there is a critical issue in the function where msg.sender is incorrectly used instead of depositor during the asset transfer

Vulnerability Details

IERC20(reserve.reserveAssetAddress).safeTransferFrom(
msg.sender, // from
reserve.reserveRTokenAddress, // to
amount // amount
);

The function attempts to transfer amount of the reserve asset from msg.sender to the reserve.reserveRTokenAddress. However, since msg.sender is the contract itself (as it is an internal function), it may not be the actual depositor. This could lead to unexpected behavior, including failed transactions or improper fund deductions.

Impact

User can not deposit.

Tools Used

Manual code review

Recommendations

IERC20(reserve.reserveAssetAddress).safeTransferFrom(
- msg.sender,
+ depositor,
reserve.reserveRTokenAddress, // to
amount // amount
);
​
Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.