Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Incorrect implementation of _rebalanceLiquidity() in lending pool

valy001

Summary

_depositIntoVault() and _withdrawFromVault() implement a wrong deposit source and withdraw target address in LendingPool contract

Vulnerability Details

LendingPool::_rebalanceLiquidity() is used for rebalance token assets between reserve and vault to maintain a desired ratio. While these two functions are implemented in LendingPool.sol contract , they implement wrong deposit source and withdraw target addresses, which will make these function unusable.

function _rebalanceLiquidity() internal {
...
if (currentBuffer > desiredBuffer) {
uint256 excess = currentBuffer - desiredBuffer;
// Deposit excess into the Curve vault
_depositIntoVault(excess); //@audit
} else if (currentBuffer < desiredBuffer) {
uint256 shortage = desiredBuffer - currentBuffer;
// Withdraw shortage from the Curve vault
_withdrawFromVault(shortage);
}
​
emit LiquidityRebalanced(currentBuffer, totalVaultDeposits);
}

Within _depositIntoVault() function, funds are deposited into vault by calling vault.deposit():

function _depositIntoVault(uint256 amount) internal {
IERC20(reserve.reserveAssetAddress).approve(address(curveVault), amount);
curveVault.deposit(amount, address(this)); //@audit
totalVaultDeposits += amount;
}

However, tokens are actually stored in reserve/RToken contract, not lending pool, therefor will not result intended deposit since lending pool does not hold assets.

Similar issue exsits in _withdrawFromVault() function, where asset token should be withdraw to reserve?RToekn contract, not lending pool contract.

function _withdrawFromVault(uint256 amount) internal {
curveVault.withdraw(amount, address(this), msg.sender, 0, new address[](0));//@audit
}

(All above issues are based on that withdraw()/borrow() actions in lending pool are excuted to withdraw tokens from reserve/RToken contract, not lending pool, hence when rebalancing, token should deposit from and withdraw to RToken contract)

Impact

protocol functionality breaking

Tools Used

manual

Recommendations

consider changing the deposit from address and withdraw target address

Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_depositIntoVault and _withdrawFromVault don't transfer tokens between RToken and LendingPool, breaking Curve vault interactions

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_depositIntoVault and _withdrawFromVault don't transfer tokens between RToken and LendingPool, breaking Curve vault interactions

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.