Core Contracts

Summary

In the `LendingPool` contract, the _withdrawFromVault() function, the curveVault.withdraw() function is called with msg.sender as the owner instead of address(this). Since deposits mint vault shares to address(this), withdrawals should burn those shares from the same owner (address(this)). Using msg.sender instead of address(this) can prevent the contract from successfully withdrawing funds, leading to a loss of liquidity.

Vulnerability Details

In the _depositIntoVault() function, assets are deposited into the Curve vault, and shares are minted to address(this), meaning the contract itself becomes the owner of the shares.

https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/pools/LendingPool/LendingPool.sol#L799C2-L803C6

In the _withdrawFromVault() function, the curveVault.withdraw() function attempts to burn shares from msg.sender instead of address(this). However, since the shares were minted to address(this), the correct owner for burning these shares should also be address(this).

https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/pools/LendingPool/LendingPool.sol#L809C3-L812C6

Impact

• Failed Withdrawals: If msg.sender is not address(this), the withdrawal will fail because the vault does not recognize msg.sender as the owner of the shares.

• Loss of Funds: The contract may not be able to reclaim its deposits, leading to funds being locked in the vault.

The above issue lead to failure in Ensure sufficient liquidity is available while performing withdraw or borrow and Rebalance liquidity after deposit, withdrawal and borrowing.

Tools Used

Recommendations