Core Contracts

## Summary

In the _rebalanceLiquidity function, when the current buffer exceeds the desired buffer, the contract attempts to deposit of excess liquidity into the Curve vault. However, the contract checks the buffer based on the reserve.reserveAssetAddress, which holds the liquidity, so then try to make a deposit of execess amount to curveVault from lending pool

## Vulnerability Details

• Issue:

  • The contract checks the excess liquidity using the balance of reserve.reserveAssetAddress, and make a deposit of excess tokens.

  • Therefore, before approving the transfer of assets to the Curve vault, the contract should first ensure that the necessary amount of assets is transferred from the reserve.reserveRTokenAddress to lending pool. If this transfer is not made, the deposit will fail into the Curve vault will revert. because curve vault try to transfer from the lending pool because it has approved to curve vault the execess buffer.

• Incorrect Code:

  uint256 currentBuffer = IERC20(reserve.reserveAssetAddress).balanceOf(reserve.reserveRTokenAddress);

  After determining that there is an excess liquidity buffer, the contract attempts to deposit it into the Curve vault without first transferring the assets from reserve.reserveRTokenAddress to lending pool. from where curve vault will try to TransferFrom tokens

## Impact

• Failed Deposit to Curve Vault:

  • The contract will fail to deposit excess liquidity into the Curve vault because the assets are not transferred from the reserve RToken address to the actual lending pool address before the deposit.

• Liquidity Imbalance

## Tools Used

• Manual inspection of contract logic.

## Recommendations

1. Transfer Assets Before Approving the Deposit:

   • Before calling the approve function to authorize the Curve vault to use the asset, transfer the excess amount from reserve.reserveRTokenAddress to lending pool/address(this) . This ensures the lending pool has the necessary liquidity for the deposit to curve pool.
     Corrected code:

   @ ADD this >>> IRToken(reserve.reserveRTokenAddress).transferAsset(address(this), excess);

   ERC20(reserve.reserveAssetAddress).approve(address(curveVault), amount);

   curveVault.deposit(amount, address(this));

   totalVaultDeposits += amount;