Submission Details
Severity:
H-3 Liquidity check before use in LendingPool.sol::_ensureLiquidity
Summary
If _ensureLiquidity is called within an external function like withdraw(), an attacker may be able to drain liquidity by repeatedly triggering withdrawals.
function _ensureLiquidity(uint256 amount) internal {
// if curve vault is not set, do nothing
if (address(curveVault) == address(0)) {
return;
}
uint256 availableLiquidity = IERC20(reserve.reserveAssetAddress).balanceOf(reserve.reserveRTokenAddress);
if (availableLiquidity < amount) {
uint256 requiredAmount = amount - availableLiquidity;
// Withdraw required amount from the Curve vault
_withdrawFromVault(requiredAmount);
}
}
Vulnerability Details
If an attacker calls withdraw() multiple times in quick succession, they can trigger _ensureLiquidity() each time, draining the vault
Impact
Attackers could drain the vault before legitimate users can withdraw and users may face failed withdrawals
Tools Used
Manual Review
Recommendations
Prevent rapid, repeated withdrawals from the vault by adding a cooldownDuration
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.