Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

LendingPool's _depositIntoVault always fails due to token flow issue

DRUGstore

Summary

The _depositIntoVault function in the LendingPool contract attempts to deposit tokens from LendingPool contract into the Curve vault, but this operation will fail because by design, the LendingPool contract does not hold any asset tokens.

Vulnerability Details

The issue occurs because:

  1. All user deposits(asset Tokens) in the protocol are held by the RToken contract

  2. The LendingPool contract never receives or holds the actual asset tokens

  3. The approve and deposit calls will revert due to insufficient token balance in LendingPool

function _depositIntoVault(uint256 amount) internal {
IERC20(reserve.reserveAssetAddress).approve(address(curveVault), amount);
curveVault.deposit(amount, address(this));//@audit this will fail as this contract does not have any asset Tokens
totalVaultDeposits += amount;
}
​

Impact

  1. Failed Transactions: All vault deposit operations will revert due to insufficient token balance

  2. Blocked Functionality: Protocol cannot utilize Curve vault for yield generation

Recommendations

  1. Either Implement a function in RToken contract that performs vault deposits or

  2. transfer assets from RToken contract to LendingPool first, then attempt to deposit into vault.

    for example:

function _depositIntoVault(uint256 amount) internal {
// First transfer from RToken to LendingPool
++ IRToken(reserve.reserveRTokenAddress).transferAsset(address(this), amount);
// Now LendingPool can deposit into vault
IERC20(reserve.reserveAssetAddress).approve(address(curveVault), amount);
curveVault.deposit(amount, address(this));
totalVaultDeposits += amount;
}
​
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_depositIntoVault and _withdrawFromVault don't transfer tokens between RToken and LendingPool, breaking Curve vault interactions

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_depositIntoVault and _withdrawFromVault don't transfer tokens between RToken and LendingPool, breaking Curve vault interactions

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!