Core Contracts

Summary

In the _rebalanceLiquidity function, when the available liquidity buffer exceeds the desired buffer, the contract attempts to deposit the excess liquidity into the Curve vault. However, the function incorrectly assumes that the lending pool (address(this)) already holds the excess liquidity, while the actual assets reside in reserve.reserveRTokenAddress. Without first transferring these assets to the lending pool, the deposit call to the Curve vault will fail, causing a contract malfunction.

Vulnerability Details

Issue

• The contract checks the excess liquidity using the balance of reserve.reserveAssetAddress at reserve.reserveRTokenAddress.

• If there is excess liquidity, the contract attempts to deposit the excess amount into the Curve vault.

• However, the deposit function assumes that the lending pool (address(this)) already holds the excess liquidity, which is incorrect.

• Since the Curve vault calls transferFrom to withdraw the tokens, and the lending pool has not yet received the assets, the deposit will fail due to insufficient funds.

Incorrect Code

• The contract determines the excess liquidity but does not transfer the tokens from reserve.reserveRTokenAddress to the lending pool before depositing them into the Curve vault.

• This leads to a failed deposit since the Curve vault expects the lending pool to hold the required assets.

Impact

Failed Deposit to Curve Vault

• The lending pool does not have the required assets, causing the Curve vault’s deposit function to revert.

• This prevents proper liquidity rebalancing and disrupts the expected financial operations.

Liquidity Imbalance

• If excess liquidity is not deposited correctly, the system may have inefficient capital allocation, leading to potential liquidity shortages elsewhere.

Tools Used

• Manual code review and contract behavior analysis.

Recommendations

Ensure Asset Transfer Before Depositing

• Before calling the approve function to authorize the Curve vault to use the assets, the contract should first transfer the excess liquidity from reserve.reserveRTokenAddress to the lending pool (address(this)).

• This ensures that the lending pool has the necessary assets for a successful deposit into the Curve vault.

Corrected Code

This modification ensures that the lending pool holds the required assets before attempting a deposit into the Curve vault, preventing transaction failures and maintaining proper liquidity balance.