Core Contracts

Summary

The function LendginPool::_withdrawFromVault attempts to call the withdraw function on the curveVault. However, the function call is using an incorrect interface, as the actual withdraw function in the real contract only accepts 3 arguments, not 5.

Vulnerability Details

The function is using the wrong interface for the withdraw function in the curveVault. The real contract’s withdraw function accepts only 3 arguments: assets, receiver, and owner. The current implementation includes 5 arguments, which could result in a failure to interact correctly with the Curve vault or cause an error due to the mismatch in the number of arguments.

Curve vault: https://github.com/curvefi/curve-stablecoin/blob/1238d292f961d328df05aaa8323f1d5e245b9e2a/contracts/lending/Vault.vy#L457

Impact

The mismatched function signature will likely cause the transaction to fail when interacting with the Curve vault.

Tools Used

Manual review

Recommendations

Update the function call to match the correct signature of the withdraw function in the curveVault