Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Unvalidated Vault Withdrawals in `_ensureLiquidity` Risk Failed Transactions

kobbyeugene

Summary

The _ensureLiquidity function withdraws from the Curve vault without checking if the vault has sufficient liquidity, risking failed transactions.

Vulnerability Details

If the Curve vault lacks liquidity, _withdrawFromVault(requiredAmount) will fail, but the contract proceeds as if liquidity is available, leaving the system in an inconsistent state.

if (availableLiquidity < amount) {
uint256 requiredAmount = amount - availableLiquidity;
_withdrawFromVault(requiredAmount); // @audit no check for vault liquidity
}

Impact

  • Failed Withdrawals: Users cannot withdraw/borrow despite "sufficient" liquidity.

  • Protocol Instability: Inconsistent liquidity tracking.

Tools Used

manual review

Recommendations

Add a pre-withdrawal liquidity check:

```solidity

require(curveVault.balanceOf(address(this)) >= requiredAmount, "Insufficient vault liquidity");
```

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.