Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Liquidity Rebalancing Fails for Tokens Requiring Zero Approval Reset (e.g., USDT)

pelz

Summary

The _rebalanceLiquidity function fails to rebalance liquidity when the reserve token enforces a strict zero-approval policy (e.g., USDT). The _depositIntoVault function directly approves the curveVault without resetting approval to zero, causing perpetual transaction reverts if a previous approval exists.

Vulnerability Details

In the _depositIntoVault function:

function _depositIntoVault(uint256 amount) internal {
IERC20(reserve.reserveAssetAddress).approve(address(curveVault), amount); // @audit-issue if usdt it will always fail.
curveVault.deposit(amount, address(this));
totalVaultDeposits += amount;
}

Why It Fails

  • Tokens like USDT and KNC require resetting approvals to zero before granting a new one.

  • If reserve.reserveAssetAddress is USDT and a non-zero approval already exists, the approve call reverts.

  • This halts liquidity rebalancing, preventing excess liquidity from being deposited into the Curve vault.

Impact

  • Liquidity Management Disruption: Protocol fails to maintain the desired liquidity buffer.

Tools Used

Manual code review.

Recommendations

Update _depositIntoVault to handle tokens with strict approval policies:

function _depositIntoVault(uint256 amount) internal {
IERC20 token = IERC20(reserve.reserveAssetAddress);
if (token.allowance(address(this), address(curveVault)) > 0) {
token.approve(address(curveVault), 0); // Reset approval first
}
token.approve(address(curveVault), amount); // Then approve desired amount
curveVault.deposit(amount, address(this));
totalVaultDeposits += amount;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.