Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Users Can Withdraw Anytime Before `LiquidityIndex` Decreases to Avoid Loss

kupiasec

Summary

Users have the ability to withdraw from the LendingPool at any time. Consequently, when a decrease in the LiquidityIndex is imminent, users can front-run the withdrawal process to avoid potential losses.

Vulnerability Details

Users can invoke the LendingPool.withdraw() function whenever they want, allowing them to withdraw their assets without any delay.

As a result, when the LiquidityIndex is set to decrease for any reason, users can withdraw by front-running to avoid losses, leaving remaining users at a disadvantage and incurring more losses.

function withdraw(uint256 amount) external nonReentrant whenNotPaused onlyValidAmount(amount) {
if (withdrawalsPaused) revert WithdrawalsArePaused();
​
// Update the reserve state before the withdrawal
ReserveLibrary.updateReserveState(reserve, rateData);
​
// Ensure sufficient liquidity is available
_ensureLiquidity(amount);
​
// Perform the withdrawal through ReserveLibrary
(uint256 amountWithdrawn, uint256 amountScaled, uint256 amountUnderlying) = ReserveLibrary.withdraw(
reserve, // ReserveData storage
rateData, // ReserveRateData storage
amount, // Amount to withdraw
msg.sender // Recipient
);
​
// Rebalance liquidity after withdrawal
_rebalanceLiquidity();
​
emit Withdraw(msg.sender, amountWithdrawn);
}

Impact

Users can withdraw at any time to avoid losses.

Tools Used

Manual review

Recommendations

Implement a withdrawal request mechanism to introduce a delay for withdrawals.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Appeal created

kupiasec Submitter
7 months ago
inallhonesty Lead Judge
6 months ago
inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!