Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

`StabilityPool::_withdrawFromVault` withdraws tokens to the wrong destination

nikolaihristov1999

Summary

The _withdrawFromVault function transfers tokens to the caller lending pool instead of the reserve’s rToken address. This misdirected withdrawal destination contradicts the intended liquidity management, leading to incorrect fund distribution during liquidity rebalancing.

Vulnerability Details

The function is implemented as follows

function _withdrawFromVault(uint256 amount) internal {
curveVault.withdraw(amount, address(this), msg.sender, 0, new address[](0));
totalVaultDeposits -= amount;
}

During liquidity rebalancing, the _rebalanceLiquidity function calculates the desired buffer based on the reserve asset balance held by the rToken contract:

uint256 currentBuffer = IERC20(reserve.reserveAssetAddress).balanceOf(reserve.reserveRTokenAddress);

When a shortage is detected (i.e. the current buffer is below the desired level), the contract calls _withdrawFromVault. However, by passing address(this) as the recipient instead of the rToken contract address, tokens are incorrectly transferred to the lending pool. This undermines liquidity management, as the balance is not properly replenished.

Impact

  • Liquidity Mismatch: Tokens meant to replenish the rtoken liquidity will instead go to the lending pool, potentially leaving the the rToken contract unreserved

  • Incorrect Fund Accounting: This misdirection leads to inaccurate liquidity tracking and may disrupt further operations that depend on reserve balances.

Tools Used

  • Manual Code Review

Recommendations

Update the _withdrawFromVault function so that tokens are withdrawn to the reserve’s rToken address:

function _withdrawFromVault(uint256 amount) internal {
- curveVault.withdraw(amount, address(this), msg.sender, 0, new address[](0));
+ curveVault.withdraw(amount, reserve.reserveRTokenAddress, msg.sender, 0, new address[](0));
totalVaultDeposits -= amount;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_depositIntoVault and _withdrawFromVault don't transfer tokens between RToken and LendingPool, breaking Curve vault interactions

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_depositIntoVault and _withdrawFromVault don't transfer tokens between RToken and LendingPool, breaking Curve vault interactions

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.