Submission Details
Severity:
M-2 Liquidity Manipulation in LendingPool.sol::withdraw
Summary
_ensureLiquidity(amount) checks for sufficient liquidity before calling ReserveLibrary.withdraw(). Between these two steps a drain of funds can occur.
function withdraw(uint256 amount) external nonReentrant whenNotPaused onlyValidAmount(amount) {
if (withdrawalsPaused) revert WithdrawalsArePaused();
ReserveLibrary.updateReserveState(reserve, rateData);
_ensureLiquidity(amount); // @ audit first check then withdraw?
(uint256 amountWithdrawn, uint256 amountScaled, uint256 amountUnderlying) = ReserveLibrary.withdraw(
reserve, // ReserveData storage
rateData, // ReserveRateData storage
amount, // Amount to withdraw
msg.sender // Recipient
);
// Rebalance liquidity after withdrawal
_rebalanceLiquidity();
emit Withdraw(msg.sender, amountWithdrawn);
}
Impact
If an attacker manages to manipulate liquidity between these calls, they could withdraw more than expected, leading to insolvency.
Tools Used
Manual Review
Recommendations
Lock liquidity checks and withdrawals atomically
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.