Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Incorrect receiver in vault withdrawal

falendar

Summary

In _withdrawFromVault, withdrawn assets are sent to address(this) (LendingPool), but they should be sent to reserve.reserveRTokenAddress (RToken), as RToken holds all non-vault reserve assets (crvUSD).

Vulnerability Details

LendingPool should never directly hold reserve assets, which is currently the issue:

function _withdrawFromVault(uint256 amount) internal {
> curveVault.withdraw(amount, address(this), msg.sender, 0, new address[](0));
totalVaultDeposits -= amount;
}

The Curve vault's withdraw function sends the assets to the receiver (LendingPool passes address(this)):

def withdraw(
assets: uint256, # amount to withdraw
> receiver: address, # who gets the assets
owner: address, # who owns the shares to burn
max_loss: uint256 = 0,
strategies: DynArray[address, MAX_QUEUE] = []
) -> uint256:

Impact

High: Reserve assets get stuck in LendingPool and borrowers cannot receive their borrowed funds.

Recommendations

Use RToken as the receiver. Additionally, update the owner to address(this) (see the submission "Incorrect owner in vault withdrawal" for this vulnerability):

function _withdrawFromVault(uint256 amount) internal {
- curveVault.withdraw(amount, address(this), msg.sender, 0, new address[](0));
+ curveVault.withdraw(amount, reserve.reserveRTokenAddress, address(this), 0, new address[](0));
totalVaultDeposits -= amount;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_depositIntoVault and _withdrawFromVault don't transfer tokens between RToken and LendingPool, breaking Curve vault interactions

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_depositIntoVault and _withdrawFromVault don't transfer tokens between RToken and LendingPool, breaking Curve vault interactions

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.