Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Rebalance will not work correctly

ChainDefenders

Summary

The _rebalanceLiquidity function is responsible for balancing liquidity between curveVault and reserveRTokenAddress. However, the function incorrectly assumes that excess liquidity is stored in LendingPool and tries to deposit funds from the LendingPool. Since the actual funds are in reserveRTokenAddress, the deposit attempt will fail. Additionally, the withdrawal logic does not correctly place funds back into reserveRTokenAddress, leading to potential liquidity mismanagement.

Relevant Code:

function _rebalanceLiquidity() internal {
if (address(curveVault) == address(0)) {
return;
}
​
uint256 totalDeposits = reserve.totalLiquidity; // Total liquidity in the system
uint256 desiredBuffer = totalDeposits.percentMul(liquidityBufferRatio);
uint256 currentBuffer = IERC20(reserve.reserveAssetAddress).balanceOf(reserve.reserveRTokenAddress);
​
if (currentBuffer > desiredBuffer) {
uint256 excess = currentBuffer - desiredBuffer;
_depositIntoVault(excess);
} else if (currentBuffer < desiredBuffer) {
uint256 shortage = desiredBuffer - currentBuffer;
_withdrawFromVault(shortage);
}
​
emit LiquidityRebalanced(currentBuffer, totalVaultDeposits);
}

Vulnerability Details

Let’s assume:

  • Total liquidity in the system = 1,000

  • Liquidity buffer ratio = 10%

  • Desired buffer (desiredBuffer) = 10% of 1,000 = 100

  • Current buffer (currentBuffer) = 90

Now, since currentBuffer (90) is less than desiredBuffer (100), the contract will try to withdraw 10 tokens from the Curve Vault using _withdrawFromVault(10).

What goes wrong?

  1. The withdrawn funds stay in the contract itself, instead of being transferred to reserveRTokenAddress.

Impact

The whole rebalance is incorect, because the funds stays in the LendingPool.

Tools Used

Manual review

Recommendations

Fix how the funds are transfer in and out of the curveVault.

Updates

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_depositIntoVault and _withdrawFromVault don't transfer tokens between RToken and LendingPool, breaking Curve vault interactions

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_depositIntoVault and _withdrawFromVault don't transfer tokens between RToken and LendingPool, breaking Curve vault interactions

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.