Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Insufficient Approval Leading to Transaction Reverts

kobbyeugene

Summary

The _withdrawFromVault function does not check if the user has approved the contract to spend their shares in the Curve vault. If approval is missing, withdrawals will revert, blocking users from accessing their funds.

Vulnerability Details

The curveVault.withdraw function requires the caller to have approval to spend the owner’s shares. In the current implementation, owner is set to msg.sender, meaning the user must have approved this contract to act on their behalf. If the approval is missing, the transaction reverts with ERC4626: insufficient allowance.

Impact

  • Users cannot withdraw assets, leading to fund lockup.

  • Breaks core protocol functionality (withdrawals).

Tools Used

manual review

Recommendations

Require users to approve the contract before calling _withdrawFromVault.

require(curveVault.allowance(msg.sender, address(this)) >= amount, "Insufficient approval");
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.