Core Contracts

Summary

External calls to curveVault.deposit/withdraw in the RAAC protocol do not check for success, risking incorrect tracking of total vault deposits.

Vulnerability Details

The _depositIntoVault() function calls curveVault.deposit() without verifying the success of the operation. If the call fails, it could lead to discrepancies in the recorded total vault deposits, affecting the protocol's accounting accuracy.

Impact

Failure to check external calls could lead to incorrect financial tracking, potentially causing issues in liquidity management and user confidence.

The project mentions compatibility with CurveVault, indicating that interactions with CurveVault are part of the protocol. Ensuring these interactions are secure and correctly handled is important.

Tools Used

• Manual review

Recommendations

Add a require(success) check after external calls to ensure operations were successful.