Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect Address Used in Curve Vault Withdrawal

xcrypt

Summary

In the _withdrawFromVault function, the contract mistakenly passes msg.sender as the withdrawal owner when interacting with the Curve vault. Since users do not hold Curve LP tokens directly, this causes the function to revert. The correct withdrawal owner should be address(this), ensuring the contract manages its own funds properly.

Vulnerability Details

Issue

  • The withdrawal function currently specifies msg.sender as the withdrawal owner, which is incorrect because only the contract (address(this)) holds Curve LP tokens.

  • This leads to a failed transaction since msg.sender does not own the required tokens, preventing proper liquidity rebalancing.

Affected Code

curveVault.withdraw(amount, address(this), msg.sender, 0, new address);
​

  • Incorrect: msg.sender is used as the withdrawal owner.

  • Correct: The contract itself (address(this)) should be the withdrawal owner.

Impact

Liquidity Management Issues

  • The function will revert, preventing liquidity withdrawal and affecting the protocol’s ability to rebalance assets.

  • This can lead to inefficiencies in fund management, causing operational disruptions in withdrawals and deposits.

Tools Used

  • Manual inspection of the contract logic.

Recommendations

Fix the Withdrawal Address

  • Ensure that the contract (address(this)) is used as the owner when withdrawing from the Curve vault.

Example Fix

curveVault.withdraw(amount, address(this), address(this), 0, new address);
​

  • This ensures the contract successfully retrieves its liquidity from the Curve vault.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_withdrawFromVault incorrectly uses msg.sender instead of address(this) as the owner parameter, causing vault withdrawals to fail

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_withdrawFromVault incorrectly uses msg.sender instead of address(this) as the owner parameter, causing vault withdrawals to fail

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!