Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

zero slippage in `LendingPool.sol::_withdrawFromVault()` can lead to DOS.

orangesantra

Summary

The internal function _withdrawFromVault() is used to withdraw tokens from vault, incase lending pool's crvUSD balance is low.

function _withdrawFromVault(uint256 amount) internal {
// @audit - hardcoded slippage can lead to fund stuck forever, as loss margin is set to 0.
curveVault.withdraw(amount, address(this), msg.sender, 0, new address[](0));
totalVaultDeposits -= amount;
}

The params for withdraw function are :-

/**
* @notice Withdraws assets from the vault
* @param assets Amount of assets to withdraw
* @param receiver Address to receive the assets
* @param owner Owner of the shares
* @param maxLoss Maximum acceptable loss in basis points
* @param strategies Optional specific strategies to withdraw from
* @return shares Amount of shares burned
*/
function withdraw(
uint256 assets,
address receiver,
address owner,
uint256 maxLoss,
address[] calldata strategies
)

The maxLoss as mentioned, it's "Maximum acceptable loss in basis points", it's acts like slippage protection or clearnce value, but this can lead to DOS of this function, as there is no scope for loss margin, the market must align with requirment, which is not ideal.

In other words if market fluctates very little, the _withdrawFromVault will revert due to 0 tolerance in loss.

Vulnerability Details

loss margin set to 0, can lead to DOS.

Impact

  • _withdrawFromVault is used inside _rebalanceLiquidity.

  • _rebalanceLiquidity is used inside borrow(), withdraw() and deposit() functions of lending pool contract.

  • means there is high probability that borrow(), withdraw() and deposit() also lead to DOS.

Tools Used

Manual

Recommendations

Set loss margin to non-zero value like 5% or 6% etc.

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_withdrawFromVault hardcodes maxLoss to 0, causing reverts when Curve vault applies any fees or slippage to withdrawals

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_withdrawFromVault hardcodes maxLoss to 0, causing reverts when Curve vault applies any fees or slippage to withdrawals

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.