Core Contracts

Summary

The LendingPool attempts to deposit reserve assets into Curve once it is above a particular threshold, _depositIntoVault
function assumes that the reserve assets are held by the lending pool contract when attempting to deposit into Curve. However, the assets are actually held by RToken. This misalignment causes deposit attempts to fail, effectively breaking core protocol functionality.

Vulnerability Details

The _rebalanceLiquidity function correctly checks the balance in the RToken contract and calls _depositIntoVaultif the current balance is greater than the desired balance.

However, _depositIntoVault attempts to:

• Approve spending from the lending pool contract

• Deposit tokens from the lending pool contract

  function _depositIntoVault(uint256 amount) internal {

  IERC20(reserve.reserveAssetAddress).approve(address(curveVault), amount);

  curveVault.deposit(amount, address(this));

  totalVaultDeposits += amount;

  }

• The deposit transactions will always fail as Curve Vault will attempt to transfer the deposited tokens from the msg.sender

  ​

  def deposit(assets: uint256, receiver: address = msg.sender) -> uint256:

  ...

  assert self.borrowed_token.transferFrom(msg.sender, controller.address, assets, default_return_value=True)

  self._mint(receiver, to_mint)

  ...

Here is an implementation of the deposit function from Curve Vault docs.

• This function is called by critical operations:

  • Deposit

  • Withdraw

  • Borrow

Impact

All deposits to Curve vault will fail

• Protocol cannot optimize yield through Curve strategy

• Key functions (deposit, withdraw, borrow) will revert when attempting to rebalance once Curve vault is set

Tools Used

Manual code review

Recommendations

The lending pool should first withdraw from RTokenbefore depositing to Curve