Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

A malicious user can prevent the protocol from earning yield on the Curve vault

dimah7

Vulnerability Details

When there is an excess amount calculated between the desired buffer (20% of totalDeposits) and the current buffer (crvUSD balances of the RToken), this amount is deposited into the Curve-crvUSD vault and the lending pool gets minted equivalent shares. These shares then can be burned in order to take back the underlying asset + gained yield. And upon withdrawal if there is an insufficient balance in the RToken, the vault acts as a liquidity provider and transfers the required amount. The problem is that upon withdrawal the user is allowed to specify value greater than his balance:

function withdraw(uint256 amount) external nonReentrant whenNotPaused onlyValidAmount(amount) {
...
// Ensure sufficient liquidity is available
_ensureLiquidity(amount);
​
// Perform the withdrawal through ReserveLibrary
(uint256 amountWithdrawn, uint256 amountScaled, uint256 amountUnderlying) = ReserveLibrary.withdraw(
reserve, // ReserveData storage
rateData, // ReserveRateData storage
amount, // Amount to withdraw
msg.sender // Recipient
);
​
function _ensureLiquidity(uint256 amount) internal {
// if curve vault is not set, do nothing
if (address(curveVault) == address(0)) {
return;
}
​
uint256 availableLiquidity = IERC20(reserve.reserveAssetAddress).balanceOf(reserve.reserveRTokenAddress);
​
if (availableLiquidity < amount) {
uint256 requiredAmount = amount - availableLiquidity;
// Withdraw required amount from the Curve vault
_withdrawFromVault(requiredAmount);
}
}

As can be seen the difference between the input-specified amount and the crvUSD balances of the RToken is transfered out from the Curve vault. This opens possibilities all the balance of the Curve vault being taken out and causing loss of yield to the protocol.

Consider the following scenario:

  1. Curve vault has 1000 balance

  2. RToken has 500

  3. A user specifies to withdraw 1500

  4. 1500 - 500 = 1000 tokens will be transfered out from the Curve vault, which is all it's balance

  5. Same applies for borrows

  6. A malicious user can repeatedly make such calls, to keep Curve vault balance constantly 0, thus preventing the protocol from earning yield.

Note: if user specifies more than actually he has deposited, the tx will not revert, because the amount will be capped to his actual balance (implemented in Debt and R token)

Impact

Can purposely keep the Curve vault balances 0, thus preventing the protocol gaining yield.

Tools Used

Manual Review

Recommendations

Don't allow the user to specify an amount greater than his deposits

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_ensureLiquidity processes uncapped withdraw amounts, allowing temporary yield disruption through excessive Curve vault withdrawals

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_ensureLiquidity processes uncapped withdraw amounts, allowing temporary yield disruption through excessive Curve vault withdrawals

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!