_repay and finalizeLiquidation functions lack rebalanceLiquidity call
Summary
In the LendingPool contract the _rebalanceLiquidity function is meant to either add or remove liquidity to mantain a buffer. It's currently only being called during deposit, borrow and withdraw, but other functions that have transfers are lacking this call.
Vulnerability Details
The repay and finalizeLiquidation functions both have safeTransferFrom functions to receive reserve asset tokens for the repayment of debt, but they lack a call to__ _rebalanceLiquidity, this means that in the case of excess funds from those token inflows the protocol will be missing out on curve yield until deposit, borrow or withdraw are called and _rebalanceLiquidity is executed again.
Impact
Loss of yield.
Tools Used
Manual review.
Recommendations
Add a _rebalanceLiquidity call at the end of both the _repay and finalizeLiquidation functions.
Lead Judging Commences
LendingPool::finalizeLiquidation or repay doesn't call _rebalanceLiquidity, leaving excess funds idle instead of depositing them in Curve vault for yield
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.