Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

_withdrawFromVault function doesnt transfer tokens to RToken.sol

anonymousjoe

Summary

The _withdrawFromVault function is supposed to withdraw the funds from the curveVault and transfer it to the RToken address. This doesnt happen and thus the withdraw/borrow operations will be DOS'ed

Vulnerability Details

The withdrawFromVault function is supposed to withdraw the funds from the curveVault and transfer it to the RToken address. This can be understood by the following scenario: when a user tries to withdraw their funds, the ensureLiquidity function is called, which calls the withdrawFromVault function, and then the LendingPool proceeds to call the burn function in the rToken which tries to transfer the withdraw amount to the user. Since the withdrawFromVault function doesnt transfer the funds to the rToken this transfer will fail. With this it should be clear that the funds should be transferred to the rToken address in the _withdrawFromVault function.

if (receiverOfUnderlying != address(this)) {
IERC20(_assetAddress).safeTransfer(receiverOfUnderlying, amount);
}
// Burn function trying to transfer the amount to the user which will fail
function _ensureLiquidity(uint256 amount) internal {
// if curve vault is not set, do nothing
if (address(curveVault) == address(0)) {
return;
}
​
uint256 availableLiquidity = IERC20(reserve.reserveAssetAddress).balanceOf(reserve.reserveRTokenAddress);
​
if (availableLiquidity < amount) {
uint256 requiredAmount = amount - availableLiquidity;
// Withdraw required amount from the Curve vault
_withdrawFromVault(requiredAmount);
}
}
// called during withdraw/ borrow etc

Impact

LendingPool functions like withdraw/borrow wont work

Tools Used

manual Review

Recommendations

After withdrawing the funds from the vault transfer it to the rToken address.

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_depositIntoVault and _withdrawFromVault don't transfer tokens between RToken and LendingPool, breaking Curve vault interactions

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_depositIntoVault and _withdrawFromVault don't transfer tokens between RToken and LendingPool, breaking Curve vault interactions

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.