Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Zero Max Loss in `LendingPool::_withdrawFromVault` Can Cause Unnecessary Transaction Reverts

whitekittyhacker

Summary

The _withdrawFromVault function in LendingPool calls curveVault.withdraw(...) with maxLoss set to 0. This strict requirement can cause transactions to revert due to minimal price fluctuations, even when the losses are insignificant. This could lead to unnecessary failures and prevent withdrawals under normal market conditions.

Vulnerability Details

https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/pools/LendingPool/LendingPool.sol#L810

The `maxLoss` parameter is hardcoded to `0`, meaning that even the slightest fluctuation in asset value or rounding discrepancies in the Curve vault can cause a transaction failure.

Key issues:

  1. Even small, acceptable losses (e.g., a few basis points) can cause reverts, making withdrawals unreliable.

  2. The function does not provide flexibility to set a reasonable tolerance for minimal discrepancies.

Impact

Withdrawals may fail unnecessarily, frustrating users and causing inefficiencies.

Tools Used

Manual review

Recommendations

Modify `_withdrawFromVault` to accept a small `maxLoss` threshold to prevent unnecessary reverts due to minor fluctuations:

uint256 public constant MIN_ACCEPTABLE_LOSS = 10; // 0.1% max allowed loss
​
function _withdrawFromVault(uint256 amount) internal {
curveVault.withdraw(amount, address(this), msg.sender, MIN_ACCEPTABLE_LOSS, new address[](0));
totalVaultDeposits -= amount;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_withdrawFromVault hardcodes maxLoss to 0, causing reverts when Curve vault applies any fees or slippage to withdrawals

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_withdrawFromVault hardcodes maxLoss to 0, causing reverts when Curve vault applies any fees or slippage to withdrawals

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.