Summary

The _withdrawFromVault function in the LendingPool contract incorrectly assumes that the Curve Vault withdrawal function accepts a specific set of parameters. However, the parameters passed in the LendingPool contract do not align with the actual function signature of the Curve Vault. This mismatch can cause transaction failures or unexpected behavior due to the inclusion of extra parameters.

Vulnerability Details

The LendingPool contract currently calls the Curve Vault’s withdrawal function with the following signature:

However, the actual Curve Vault contract defines the withdrawal function as:

https://github.com/curvefi/curve-stablecoin/blob/1238d292f961d328df05aaa8323f1d5e245b9e2a/contracts/lending/Vault.vy#L457

Key Differences:

• Extra Parameters in LendingPool: The LendingPool function passes maxLoss and strategies, but these parameters are not supported by the actual Curve Vault withdrawal function.

• Incorrect Parameter Order: The LendingPool contract expects assets, receiver, owner, maxLoss, strategies, while the Curve Vault only accepts assets, receiver, owner. This discrepancy can cause the function call to fail or result in unexpected behavior.

Impact

1. Transaction Failure Due to Parameter Mismatch:
   The mismatch in parameters will likely cause the function to revert, blocking liquidity withdrawals and potentially halting the flow of funds.

2. Unexpected Behavior if Parameters Are Ignored:
   If the extra parameters are ignored by the Curve Vault, withdrawals might appear successful but will not behave as intended, potentially leading to erroneous contract state updates or unintended actions.

Recommendations

1. Update the Function Signature to Align with the Curve Vault Interface

• Remove the extra parameters (maxLoss, strategies) to match the actual Curve Vault function signature.

• Ensure compatibility with the Curve Vault’s withdrawal function, preventing transaction failures and ensuring correct behavior.

By aligning the withdrawal function signature with the actual Curve Vault contract, this fix eliminates the risk of failures or unexpected behavior during withdrawals, ensuring the protocol operates smoothly.