Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Missing Functionality in `LendingPool::rescueToken` Leading to Inability to Rescue Tokens in `RToken`

0x23r0

Summary

The LendingPool::rescueToken function is intended to allow the contract owner to rescue tokens mistakenly sent to the contract. However, the function does not properly call the RToken::rescueToken function, which is also responsible for handling the rescue tokens in RToken contract that have a modifier that is only called by LendignPool(ReservePool) . This oversight results in the inability to rescue tokens in RToken contract.

Vulnerability Details

The LendingPool::rescueToken function is designed to rescue tokens that are mistakenly sent to the contract. However, the function does not interact with the RToken::rescueToken function, which is also responsible for the rescue tokens.

LendingPool::rescueToken

function rescueToken(address tokenAddress, address recipient, uint256 amount) external onlyOwner {
require(tokenAddress != reserve.reserveRTokenAddress, "Cannot rescue RToken");
IERC20(tokenAddress).safeTransfer(recipient, amount);
}

The RToken::rescueToken function, which should be called by the ReservePool because of onlyReservePool modifier :

function rescueToken(address tokenAddress, address recipient, uint256 amount) external onlyReservePool {
if (recipient == address(0)) revert InvalidAddress();
if (tokenAddress == _assetAddress) revert CannotRescueMainAsset();
IERC20(tokenAddress).safeTransfer(recipient, amount);
}

Impact

The inability to rescue tokens from RToken contract.

Tools Used

Manual Review

Recommendations

The LendingPool::rescueToken function should be modified to call the RToken::rescueToken function. This ensures that all necessary checks and balances are in place before transferring the tokens. Here is the recommended change:

​
function rescueToken(address tokenAddress, address recipient, uint256 amount) external onlyOwner {
require(tokenAddress != reserve.reserveRTokenAddress, "Cannot rescue RToken");
IERC20(tokenAddress).safeTransfer(recipient, amount);
​
+ IRToken(reserve.reserveRTokenAddress).rescueToken(tokenAddress, recipient, amount);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RToken::rescueToken() can never be called

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!