Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Withdrawals from CRV vaults will revert due to incorrect shares owner passed

charlescheerful

Vulnerability Details

This problem arises from the LendingPool::_withdrawFromVault() function. The 3rd argument is wrong and will make the tx always revert.

As per the interface provided ICurveCrvUSDVault, see here:

/**
* @notice Deposits assets into the vault
* @param assets Amount of assets to deposit
@> * @param receiver Address to receive the shares // 🟢👁️ When depositing 2nd arg receives the shares
* @return shares Amount of shares minted
*/
function deposit(uint256 assets, address receiver) external returns (uint256 shares);

When LendingPool deposits in curve this address is address(this), the very same LendingPool. See here.

And as per the withdraw() interface:

/**
* @notice Withdraws assets from the vault
* @param assets Amount of assets to withdraw
* @param receiver Address to receive the assets
@> * @param owner Owner of the shares // 🟢👁️
* @param maxLoss Maximum acceptable loss in basis points
* @param strategies Optional specific strategies to withdraw from
* @return shares Amount of shares burned
*/
function withdraw(
uint256 assets,
address receiver,
address owner,
uint256 maxLoss,
address[] calldata strategies
) external returns (uint256 shares);

But when withdrawing lending pool passes msg.sender as the owner argument instead of address(this) (see here), which is incorrect and will likely result in reverts. As the user will not have any shares himself or in case he does, he won't have approvals to LendingPool to move his shares.

Impact

_withdrawFromVault() is incorrectly implemented due to the owner argument. DOSing vital funcitons that depend on it like LendingPool::withdraw() or LendingPool::borrow(). They both call withdrawFromVault() form _ensureLiquidity().

Recommendations

At _withdrawFromVault() the owner arg should be address(this).

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_withdrawFromVault incorrectly uses msg.sender instead of address(this) as the owner parameter, causing vault withdrawals to fail

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_withdrawFromVault incorrectly uses msg.sender instead of address(this) as the owner parameter, causing vault withdrawals to fail

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.