Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

`_depositIntoVault()` always going to fail, as reserveAsset already sent to rToken address

0xhacksmithh

Summary

Vulnerability Details

_depositIntoVault()is part of _rebalanceLiquidity()function which Rebalances liquidity between the buffer and Curve vault to maintain a desired buffer ratio.

_rebalanceLiquidity() does following things

uint256 totalDeposits = reserve.totalLiquidity; // Total liquidity in the system
uint256 desiredBuffer = totalDeposits.percentMul(liquidityBufferRatio);
uint256 currentBuffer = IERC20(reserve.reserveAssetAddress).balanceOf(reserve.reserveRTokenAddress);

Point to note here currentBuffer is calculated based on Reserve Assets hold inside RToken address

and depending upon buffer, it decides whether to depositor `withdraw` from Curve vault

if (currentBuffer > desiredBuffer) {
uint256 excess = currentBuffer - desiredBuffer;
// Deposit excess into the Curve vault
_depositIntoVault(excess);
} else if (currentBuffer < desiredBuffer) {
uint256 shortage = desiredBuffer - currentBuffer;
// Withdraw shortage from the Curve vault
_withdrawFromVault(shortage);
}
​

https://github.com/Cyfrin/2025-02-raac/blob/main/contracts/core/pools/LendingPool/LendingPool.sol#L772-L792

Now we are more intersted in _depositIntoVault()

function _depositIntoVault(uint256 amount) internal {
IERC20(reserve.reserveAssetAddress).approve(address(curveVault), amount);
curveVault.deposit(amount, address(this));
totalVaultDeposits += amount;
}

https://github.com/Cyfrin/2025-02-raac/blob/main/contracts/core/pools/LendingPool/LendingPool.sol#L799-L803

So here allowance given to curveVault for amountfrom LendingPooland in next step curveVault.deposit()called

Here point is whole thing is problematic, cause Lending pool doesnot hold any ReserveToken at current moment, all deposited Reserve Token are transfered to RToken contract previously(in ReserveLibrary :: deposit()).

https://github.com/Cyfrin/2025-02-raac/blob/main/contracts/libraries/pools/ReserveLibrary.sol#L330-L334

So _depositIntoVault()always going to failed.

Impact

_depositIntoVault() always goin to fail

Tools Used

manual review

Recommendations

should re-design this whole working process

Updates

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_depositIntoVault and _withdrawFromVault don't transfer tokens between RToken and LendingPool, breaking Curve vault interactions

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_depositIntoVault and _withdrawFromVault don't transfer tokens between RToken and LendingPool, breaking Curve vault interactions

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.