Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Wrong destination of _withdrawFromVault leads to be impossible to withdraw funds to user

moray5554

Summary

LendingPool.sol : withdraw() contains ensureLiquidity() subcall, which will triager _withdrawFromVault(). Meanwhile it confusing the adrress to where it should withraw. Leading to unexpected reverts due withdraw proccess.

Vulnerability Details

LendingPool.sol : withdraw() contains *ensureLiquidity() subcall, which will triager *withdrawFromVault(). Meanwhile it confusing the adrress to where it should withrdaw. Leading to unexpected reverts due withdraw proccess.
While withdraw tokens should happens from RToken contract address withdrawFromVault() send funds to LendingPool address. This will lead to situation when if it's not enough tokens on a balance of RToken contract we won't be able to proccess tx due to lack of funds on RToken ( the funds from curve vault contract went to LendingPool instead)\

function _withdrawFromVault(uint256 amount) internal {
​
curveVault.withdraw(amount, address(this), msg.sender, 0, new address\[]\(0));
​
totalVaultDeposits -= amount;
​
}

Impact

Dos of withdraw functionality

Tools Used

Manual review

Recommendations

Change 2nd argument(reciever) to RToken contract address

curveVault.withdraw(amount, address(this), msg.sender, 0, new address);
Updates

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_depositIntoVault and _withdrawFromVault don't transfer tokens between RToken and LendingPool, breaking Curve vault interactions

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_depositIntoVault and _withdrawFromVault don't transfer tokens between RToken and LendingPool, breaking Curve vault interactions

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.