Submission Details
Severity:
LendingPool can become unusable because of too strict slippage protection
Summary
LendingPool can withdraw funds from curve's vault, if deemed necesary. Slippage protection is extremely strict and the withdraw can cause DOS
Vulnerability Details
In LendingPool, this is the fn to get the funds from curve's vault, in case there isnt enough in the contact:
function _withdrawFromVault(uint256 amount) internal {
curveVault.withdraw(amount, address(this), msg.sender, 0, new address[](0));
totalVaultDeposits -= amount;
}
Third paremeter is 0, which makes it so that loss value is 0. This is too strict and may cause DOS.
Impact
DOS in the LendingPool contact
Tools Used
Manual review
Recommendations
Increase slippage
Updates
Lead Judging Commences
inallhonesty 6 months ago
Submission Judgement Published Assigned finding tags:
LendingPool::_withdrawFromVault hardcodes maxLoss to 0, causing reverts when Curve vault applies any fees or slippage to withdrawals
inallhonesty 6 months ago
Submission Judgement Published Assigned finding tags:
LendingPool::_withdrawFromVault hardcodes maxLoss to 0, causing reverts when Curve vault applies any fees or slippage to withdrawals
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420
USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.