Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Hardcoded `0 bps` acceptable max loss may render LendingPool unable to withdraw from `curveVault`

alexczm

Summary

LendingPool uses a hardcoded 0 BPS when withdrawing from curveVault.
As a result, LendingPool may be temporarily or even permanently unable to withdraw from curveVault

Vulnerability Details

The LendingPool deposits a part of its liquidity to curve vault for additional rewards for LPs.

On withdraw or borrow to/from LendingPool, if required, LendingPool withdraws from the curveVault to ensure sufficient liquidity is available.

function _withdrawFromVault(uint256 amount) internal {
curveVault.withdraw(amount, address(this), msg.sender, 0, new address[](0));
totalVaultDeposits -= amount;
}

The curveVault is the savings crvUSD vault which make use of Yearn V3 vault.

According to Yearn docs the maxLoss is defined as:

There is a maxLoss parameter for both withdraw and redeem that is denominated in basis points.
This value will enforce the max amount of allowable loss the user will accept during the withdraw
and revert if the loss is over that amount.

The problem is that the maxLoss used to withdraw from curveVault is hardcoded to 0 BPS.

If the loss is even slightly higher than 0 BPS, the transaction reverts.
This may result in the inability to withdraw funds from the curveVault.

Impact

The lendingPool may be temporary unable to fulfill withdraw and/or borrow request even if total liquidity (balance of LendingPool and the amount deposited in curveValut) is sufficient.

On extreme cases, when a loss greater than 0 bps persists, the funds deposited in curveVault may not be withdrawable at all.

Tools Used

Recommendations

Consider implementing one of the following :

  • use a configurable value > 0 BPS for maxLoss . Only admin/governance can update this value;

  • use redeem instead of withdraw as suggested by Yearn; do not overwrite the maxLoss default value, but keep in mind that:

redeem Defaults to a maxLoss of 10_000 (100%), meaning it will allow any amount of loss.
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_withdrawFromVault hardcodes maxLoss to 0, causing reverts when Curve vault applies any fees or slippage to withdrawals

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_withdrawFromVault hardcodes maxLoss to 0, causing reverts when Curve vault applies any fees or slippage to withdrawals

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!