You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
DuplicateA valid issue that is a duplicate of an issue with `Has Duplicates` labelMediumA Medium severity issue.RewardA payout will be made for this issue
The vault cannot empty funds from a market when removing it.
Summary
To remove a market from the vault, the protocol recommends emptying a market first using CuratedVault::reallocate() and removing it with updateWithdrawQueue() as stated in the docs.( https://github.com/zerolend/zerolend-one/wiki/CuratedVault ) However, this is not possible because of a mistake in the reallocate(). CuratedVault.sol:250
Root Cause
To empty a market the allocator is to pass 0 in allocations.assets. CuratedVault.sol:232
function reallocate(MarketAllocation[] calldataallocations) external onlyAllocator {
However, In CuratedVault.sol:247-250, if allocation.assets == 0, it sets the toWithdraw to 0
// Guarantees that unknown frontrunning donations can be withdrawn, in order to disable a market.uint256 shares;
if (allocation.assets ==0) {
shares = supplyShares;
toWithdraw =0;
}
Then the function tries to call pool.withdrawSimple with toWithdraw as 0. (CuratedVault.sol:253)
This would result in the function reverting, as it does not take zero as input. (ValidationLogic.sol:97)
Internal pre-conditions
The allocator of the vault needs to call reallocate().
External pre-conditions
None
Attack Path
None
Impact
This would leave the vault no choice but to remove a market via CuratedVault::submitMarketRemoval() and updateWithdrawQueue(), which would leave to loss of funds of the market. Because of this bug, the only way to reallocate or empty funds from a market would be to ask all the suppliers of the vault to withdraw their funds, removing the market and asking them to supply back.
PoC
No response
Mitigation
If the developers want to make sure unknown front-running donations are withdrawn, simply set the toWithdraw to type(uint256).max. This will withdraw the whole vault balance of this particular market.(SupplyLogic.sol:121)
sherlock-admin3
changed the title
Bent Berry Cobra - The vault cannot empty funds from a market when removing it.
wickie - The vault cannot empty funds from a market when removing it.
Oct 3, 2024
DuplicateA valid issue that is a duplicate of an issue with `Has Duplicates` labelMediumA Medium severity issue.RewardA payout will be made for this issue
wickie
Medium
The vault cannot empty funds from a market when removing it.
Summary
To remove a market from the vault, the protocol recommends emptying a market first using
CuratedVault::reallocate()
and removing it withupdateWithdrawQueue()
as stated in the docs.( https://github.com/zerolend/zerolend-one/wiki/CuratedVault ) However, this is not possible because of a mistake in thereallocate()
.CuratedVault.sol:250
Root Cause
To empty a market the allocator is to pass
0
inallocations.assets
.CuratedVault.sol:232
However, In
CuratedVault.sol:247-250
, ifallocation.assets
== 0, it sets thetoWithdraw
to0
Then the function tries to call
pool.withdrawSimple
withtoWithdraw
as 0. (CuratedVault.sol:253
)This would result in the function reverting, as it does not take zero as input. (
ValidationLogic.sol:97
)Internal pre-conditions
The allocator of the vault needs to call
reallocate()
.External pre-conditions
None
Attack Path
None
Impact
This would leave the vault no choice but to remove a market via
CuratedVault::submitMarketRemoval()
andupdateWithdrawQueue()
, which would leave to loss of funds of the market. Because of this bug, the only way to reallocate or empty funds from a market would be to ask all the suppliers of the vault to withdraw their funds, removing the market and asking them to supply back.PoC
No response
Mitigation
If the developers want to make sure unknown front-running donations are withdrawn, simply set the
toWithdraw
totype(uint256).max
. This will withdraw the whole vault balance of this particular market.(SupplyLogic.sol:121
)Duplicate of #434
The text was updated successfully, but these errors were encountered: