Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

`setCurveVault` it's not withdrawing funds

ChainDefenders

Summary

In the LendingPool contract, if the owner changes the curveVault address using the setCurveVault function, all funds previously deposited into the old vault will become inaccessible, effectively getting stuck in the old vault.

function setCurveVault(address newVault) external onlyOwner {
require(newVault != address(0), "Invalid vault address");
address oldVault = address(curveVault);
curveVault = ICurveCrvUSDVault(newVault);
emit CurveVaultUpdated(oldVault, newVault);
}

Vulnerability Details

The function allows the owner to change the curveVault at any time, but it does not transfer funds from the old vault to the new one.

Example Scenario

  1. The protocol initially sets curveVault = Vault A.

  2. Users deposits 1,000 USDC and part of these funds are deposited into Vault A.

  3. The owner calls setCurveVault(Vault B), switching to a new vault.

  4. The contract now interacts with Vault B, but part of the 1,000 USDC remains stuck, as there is no function to transfer it out.

Impact

  • User Funds May Become Irretrievable – If users have funds in the old vault, they will be permanently stuck. Also the variable that hold the current amount which is hold by vault, will have a wrong value.

Tools Used

Manual review

Recommendations

Migrate Funds Before Changing Vaults
Implement a safe migration function that withdraws all funds from the old vault before updating to a new vault.

Updates

Lead Judging Commences

inallhonesty Lead Judge about 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::setCurveVault doesn't withdraw funds from old vault before changing address, permanently locking deposited assets

inallhonesty Lead Judge about 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::setCurveVault doesn't withdraw funds from old vault before changing address, permanently locking deposited assets

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.