Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

`LendingPool._ensureLiquidity()` Does Not Send Withdrawn Assets to the `RToken` Contract

kupiasec

Summary

The LendingPool._ensureLiquidity() function is designed to ensure that enough underlying assets are available in the RToken for user withdrawals. However, it only withdraws assets from the curveVault to the LendingPool contract itself and does not send the withdrawn assets to the RToken contract. Consequently, it cannot ensure sufficient underlying assets in the RToken contract.

Vulnerability Details

The _ensureLiquidity() function aims to ensure enough underlying assets in the RToken for user withdrawals.

To achieve this, it calls the _withdrawFromVault() function at line 765.

function _ensureLiquidity(uint256 amount) internal {
...
​
uint256 availableLiquidity = IERC20(reserve.reserveAssetAddress).balanceOf(reserve.reserveRTokenAddress);
​
if (availableLiquidity < amount) {
uint256 requiredAmount = amount - availableLiquidity;
// Withdraw required amount from the Curve vault
765 _withdrawFromVault(requiredAmount);
}
}

However, the _withdrawFromVault() function sets the second parameter (representing the receiver) of curveVault.withdraw() to address(this), which means it withdraws the needed assets from the curve vault to the LendingPool contract itself, rather than to the RToken contract.

function _withdrawFromVault(uint256 amount) internal {
810 curveVault.withdraw(amount, address(this), msg.sender, 0, new address[](0));
totalVaultDeposits -= amount;
}

As a result, the _ensureLiquidity() function cannot ensure enough underlying assets in the RToken contract for user withdrawals.

Impact

Users cannot withdraw.

Tools Used

Manual review

Recommendations

Set the receiver to the RToken contract.

function _withdrawFromVault(uint256 amount) internal {
- curveVault.withdraw(amount, address(this), msg.sender, 0, new address[](0));
+ curveVault.withdraw(amount, address(rToken), msg.sender, 0, new address[](0));
totalVaultDeposits -= amount;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_depositIntoVault and _withdrawFromVault don't transfer tokens between RToken and LendingPool, breaking Curve vault interactions

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_depositIntoVault and _withdrawFromVault don't transfer tokens between RToken and LendingPool, breaking Curve vault interactions

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!