Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Excessive withdrawals from the curve vault

vasquez

Summary

In RToken::burn, the amount parameter is not properly validated against the user's balance. Instead of reverting when the amount exceeds the user's balance, it silently caps the amount to the user's balance:

if (amount > userBalance) {
amount = userBalance;
}

This is exploited in LendingPool::withdraw which uses this amount parameter to ensure sufficient liquidity is available via _ensureLiquidity(). An attacker can pass a very large amount to force the protocol to withdraw all funds from the Curve vault, even though they will only receive their actual balance.

Impact

This allows any user with a small RToken balance to:

  1. Force unnecessary withdrawals from the Curve vault by passing inflated amounts

  2. Cause loss of yield for other users as funds are pulled from the yield-generating vault

Recommendations

The amount should be validated against the user's balance before attempting to ensure liquidity:

function withdraw(uint256 amount) external nonReentrant whenNotPaused onlyValidAmount(amount) {
if (withdrawalsPaused) revert WithdrawalsArePaused();
​
ReserveLibrary.updateReserveState(reserve, rateData);
​
+ uint256 userBalance = IERC20(reserve.reserveRTokenAddress).balanceOf(msg.sender);
+ if (amount > userBalance) revert InsufficientBalance();
​
_ensureLiquidity(amount);
(uint256 amountWithdrawn, uint256 amountScaled, uint256 amountUnderlying) = ReserveLibrary.withdraw(
reserve,
rateData,
amount,
msg.sender
);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_ensureLiquidity processes uncapped withdraw amounts, allowing temporary yield disruption through excessive Curve vault withdrawals

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_ensureLiquidity processes uncapped withdraw amounts, allowing temporary yield disruption through excessive Curve vault withdrawals

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!