Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

_withdrawFromVault function Misdirects Assets to LendingPool, Causing RToken Liquidity Crisis

DRUGstore

Summary

Vault Assets Stranded in LendingPool Instead of RToken

  1. _withdrawFromVault Misdirection: functions sends assets to LendingPool instead of RToken contract.The protocol's operational design is that all asset tokens are stored in and managed by the RToken contract. During user deposits and withdrawls, crvUSD is moved in and out from RToken contract.

Vulnerability Details

During user deposits, All assetTokens(crvUSD) are stored in RToken contract.
Idea is to move assetTokens between curve-vault and RToken contract . However,

DepositIntoVault: assetTokens move from : RToken → Vault
WithdrawFromVault: assetTokens move from: Vault → LendingPool (should go to RToken instead)

withdrawFromVaultfunction is used in other functions like ensureLiquidity, rebalanceLiquidity, to manage assetTokens between curve Vault and Rtoken contract.

function _withdrawFromVault(uint256 amount) internal {
//@audit vault funds are going into LendingPool(address(this)),not into RToken contract
curveVault.withdraw(amount, address(this), msg.sender, 0, new address[](0));
totalVaultDeposits -= amount;
}
​

Impact

  • functions like _ensureLiquidity,rebalanceLiquidityare no longer useful.

  • failed user withdrawls: If funds from vault don't go into RToken contract,eventually RToken contract will not have sufficient balance to process user withdrawls.

  • Stranded Liquidity: Assets accumulate in LendingPool instead of circulating back to RToken

Recommendations

Adjust the call to the following:

curveVault.withdraw(
amount,
reserve.reserveRTokenAddress, // ✅ Correct destination
msg.sender,
0,
new address[](0)
);
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_depositIntoVault and _withdrawFromVault don't transfer tokens between RToken and LendingPool, breaking Curve vault interactions

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_depositIntoVault and _withdrawFromVault don't transfer tokens between RToken and LendingPool, breaking Curve vault interactions

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!