Core Contracts

Summary

The _withdrawFromVault function in the LendingPool contract interacts with the Curve Vault to withdraw liquidity. However, the Curve Vault implementation includes a check that ensures the total assets remaining in the vault do not fall below a predefined MIN_ASSETS threshold. If a withdrawal request violates this condition, the transaction will revert, potentially making it impossible to withdraw funds under certain conditions.

Vulnerability Details

• Issue:

  • The Curve Vault's withdraw function contains the following assertion:

    assert total_assets - assets >= MIN_ASSETS or total_assets == assets, "Need more assets"

    ​

  • This condition ensures that after a withdrawal, the vault must retain at least MIN_ASSETS unless the entire balance is being withdrawn.

  • If _withdrawFromVault attempts to withdraw an amount that would reduce the total vault balance below MIN_ASSETS, the transaction will revert.

Impact

• Withdrawals may frequently fail, especially if the vault balance is low or close to MIN_ASSETS.

• while attempting to withdraw liquidity may find the transactions reverting unexpectedly.

• If no logic exists to handle these failures gracefully, it could result in funds being locked in the vault until sufficient assets are deposited again.

Recommendations

1. Check Available Withdrawable Balance:

   • Before attempting a withdrawal, query the Curve Vault to determine the maximum amount that can be withdrawn without triggering the MIN_ASSETS condition.

   • Implement a safeguard that prevents executing a withdrawal request if it would cause the transaction to revert.

2. Handle Partial Withdrawals:

   • If the requested withdrawal amount exceeds the available withdrawable balance (total assets - MIN_ASSETS), adjust the withdrawal amount dynamically.