Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect Share Ownership in LendingPool::_withdrawFromVault May Cause Failed Withdrawals

whitekittyhacker

Summary

The _withdrawFromVault function in LendingPool incorrectly uses msg.sender as the share owner when calling curveVault.withdraw(...). Since the contract itself owns the shares, this can result in failed withdrawals due to an ownership mismatch.

Vulnerability Details

https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/pools/LendingPool/LendingPool.sol#L810

Currently, the function executes:

curveVault.withdraw(amount, address(this), msg.sender, 0, new address );

Here, msg.sender is used as the share owner, but the contract (address(this)) holds the shares, not the external caller. This may lead to the following issues:

  1. The withdrawal will fail if the Curve vault requires the correct ownership to authorize the transaction.

  2. The contract (LendingPool) should be the share owner, not msg.sender.

Impact

Withdrawals may fail due to incorrect share ownership, preventing liquidity withdrawal from the Curve vault.

Tools Used

Manual code review

Recommendations

Correct the ownership reference to address(this) to ensure successful withdrawals:

function _withdrawFromVault(uint256 amount) internal {
curveVault.withdraw(amount, address(this), address(this), 0, new address[](0));
totalVaultDeposits -= amount;
}
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_withdrawFromVault incorrectly uses msg.sender instead of address(this) as the owner parameter, causing vault withdrawals to fail

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_withdrawFromVault incorrectly uses msg.sender instead of address(this) as the owner parameter, causing vault withdrawals to fail

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.