Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Internal Vault Functions Update State After External Calls

princekay

Description

Two internal vault operation functions in the protocol update state variables after making external calls, which deviates from the best practice Checks-Effects-Interactions pattern. While these are internal functions with limited exposure, maintaining consistent patterns across the codebase is important for code quality and maintainability.

Affected code

function _withdrawFromVault(uint256 amount) internal {
curveVault.withdraw(amount, address(this), msg.sender, 0, new address[](0));
totalVaultDeposits -= amount;
}
​
function _depositIntoVault(uint256 amount) internal {
IERC20(reserve.reserveAssetAddress).approve(address(curveVault), amount);
curveVault.deposit(amount, address(this));
totalVaultDeposits += amount;
}

Vulnerability details

The core issue lies in the sequencing of operations within both internal vault functions. The _withdrawFromVault function performs the withdrawal operation before decreasing totalVaultDeposits, while _depositIntoVault executes the approve and deposit calls before increasing totalVaultDeposits. This ordering deviates from the Checks-Effects-Interactions pattern.

Since these are internal functions, they can only be called by other functions within the contract, limiting the potential impact. The functions _ensureLiquidity and _rebalanceLiquidity use these vault operation functions as part of their implementation.

Tools Used

Manual Review

Recommended Mitigation Steps

While the impact is limited due to the internal nature of these functions, it's recommended to follow the Checks-Effects-Interactions pattern for consistency:

function _withdrawFromVault(uint256 amount) internal {
// Effects
totalVaultDeposits -= amount;
// Interactions
curveVault.withdraw(amount, address(this), msg.sender, 0, new address[](0));
}
​
function _depositIntoVault(uint256 amount) internal {
// Effects
totalVaultDeposits += amount;
// Interactions
IERC20(reserve.reserveAssetAddress).approve(address(curveVault), amount);
curveVault.deposit(amount, address(this));
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.