Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Missing Liquidity Rebalancing After Repayments and Liquidations

rampage

Summary

The missing call to _rebalanceLiquidity() in repayment and liquidation functions will cause reduced yield generation for the protocol as funds won't be optimally allocated between the buffer and Curve vault.

Root Cause

In LendingPool.sol and LendingPool.sol, the _repay() and finalizeLiquidation() functions do not call _rebalanceLiquidity() after updating the protocol's liquidity state. This is inconsistent with other liquidity-affecting functions like deposit, withdraw, and borrow which properly rebalance liquidity.

The _rebalanceLiquidity() function ensures optimal fund allocation:

function _rebalanceLiquidity() internal {
// if curve vault is not set, do nothing
if (address(curveVault) == address(0)) {
return;
}
​
uint256 totalDeposits = reserve.totalLiquidity; // Total liquidity in the system
uint256 desiredBuffer = totalDeposits.percentMul(liquidityBufferRatio);
uint256 currentBuffer = IERC20(reserve.reserveAssetAddress).balanceOf(reserve.reserveRTokenAddress);
​
if (currentBuffer > desiredBuffer) {
uint256 excess = currentBuffer - desiredBuffer;
// Deposit excess into the Curve vault
_depositIntoVault(excess);
} else if (currentBuffer < desiredBuffer) {
uint256 shortage = desiredBuffer - currentBuffer;
// Withdraw shortage from the Curve vault
_withdrawFromVault(shortage);
}
​
emit LiquidityRebalanced(currentBuffer, totalVaultDeposits);
}

Impact

The protocol will generate suboptimal yields as funds may remain in the buffer when they could be earning yield in the Curve vault, or vice versa. This affects all users of the protocol who share in the yield generation.

Mitigation

Add calls to _rebalanceLiquidity() at the end of both _repay() and finalizeLiquidation() functions to ensure proper liquidity management after these operations.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::finalizeLiquidation or repay doesn't call _rebalanceLiquidity, leaving excess funds idle instead of depositing them in Curve vault for yield

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!