Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

When rebalancing liquidity, reserve assets are deposited to Curve Vault from LendingPool.sol instead of from RToken contract

0xgremlincat

Summary

To support lending operations, liquidity is rebalanced in LendingPool.sol via _rebalanceLiquidity(). However, in the event there is excess reserve assets, it is being transferred from LendingPool.sol instead of from rToken address.

Vulnerability Details

In _rebalanceLiquidity(), the current buffer is defined as the balance of reserve assets(crvUSD) in rToken contract:

uint256 currentBuffer = IERC20(reserve.reserveAssetAddress).balanceOf(reserve.reserveRTokenAddress);
​
if (currentBuffer > desiredBuffer) {
uint256 excess = currentBuffer - desiredBuffer;
// Deposit excess into the Curve vault
_depositIntoVault(excess);

Let's assume the if statement executes whereby there is excess crvUSD in rToken contract. depositIntoVault()is now called.

function _depositIntoVault(uint256 amount) internal {
IERC20(reserve.reserveAssetAddress).approve(address(curveVault), amount);
curveVault.deposit(amount, address(this));
totalVaultDeposits += amount;
}

LendingPool.sol (address(this)) deposits the excess crvUSD to the vault, instead of rToken depositing the excess to the vault.

LOC

[_depositIntoVault](https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/pools/LendingPool/LendingPool.sol#L799-L803)

Impact

Misallocation of liquidity can severely affect lending and borrowing operations, breaking the core functionality of the protocol.

Tools Used

Manual

Recommendations

In _depositIntoVault(), change the depositor address from address(this) to reserve.reserveAssetAddress

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_rebalanceLiquidity emits an event with stale buffer

Invalidated by appeal in 1090

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_rebalanceLiquidity emits an event with stale buffer

Invalidated by appeal in 1090

Appeal created

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Design choice
Assigned finding tags:

LendingPool::_rebalanceLiquidity emits an event with stale buffer

Invalidated by appeal in 1090

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!