Core Contracts

Summary

The LendingPool.sol contract incorrectly tracks deposits in the Curve crvUSD vault by recording the deposited crvUSD amount rather than the received vault shares. Since vault shares appreciate in value as the vault generates yield, this creates a growing discrepancy between the tracked and actual value of vault deposits, leading to potential issues with liquidity management and withdrawal handling.

Vulnerability Details

The LendingPool.sol implements a liquidity management system where excess crvUSD is deposited into a Curve vault, tracked through the totalVaultDeposits variable. However, when interacting with the vault, the contract fails to account for the share-based mechanics of vault tokens:

The vault converts deposits to shares using this formula:

shares = assets * (total_supply / total_assets)

As the vault generates yield, total_assets increases while total_supply remains constant, meaning each share becomes worth more crvUSD over time. The contract's tracking of crvUSD amounts rather than shares fails to account for this appreciation.

This issue is particularly evident in the withdrawal function:

When withdrawing, the contract deducts the crvUSD amount from totalVaultDeposits, but this amount no longer accurately represents the shares being consumed due to yield appreciation.

Additionally, Protocol accounting and financial reporting will be inaccurate and this will lead to issues; the extra generated yield should be redistributed into the protocol to various different categories (RToken, governance, team etc) but the shares are never recorded virtually.

Impact

High:

1. The liquidity buffer ratio becomes inaccurate over time as the true value of vault deposits grows higher than tracked

2. Rebalancing operations may make incorrect decisions based on understated vault value

3. The contract might fail to maintain adequate liquidity buffers, potentially leading to failed withdrawals

4. Protocol accounting and financial reporting inaccuracies.

Likelihood

Medium - The issue manifests gradually as yield accrues in the vault and the impact depends on yield rates and deposit duration. The problem compounds over time, becoming more severe as the vault generates returns.

Recommendations

Use a virtual balance to track shares. Many subsequent changes need to take place for system accounting but this is imperative since the protocol is integrating heavily with crvUSD vaults and seemlessly depositing and withdrawing from it.