Submission Details
Severity:
Hardcoded `maxLoss=0` Leading to Withdrawal Failures
Summary
The maxLoss parameter is hardcoded to 0, causing withdrawals to revert under normal market conditions (e.g., minor slippage).
Vulnerability Details
maxLoss=0 enforces a 0% loss tolerance. Even trivial losses (e.g., 0.1% slippage) will revert the transaction, making withdrawals impractical.
Impact
Users cannot withdraw assets during normal operations.
Protocol usability is severely degraded.
Tools Used
Manual review
Recommendations
Allow users to specify maxLoss:
function _withdrawFromVault(uint256 amount, uint256 maxLoss) internal {
curveVault.withdraw(amount, msg.sender, msg.sender, maxLoss, new address[](0));
totalVaultDeposits -= amount;
}
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.