CapsLibrary.validateVariablePoolHasEnoughLiquidity() always revert

[c4-bot-2]

Lines of code

https://github.com/code-423n4/2024-06-size/blob/8850e25fb088898e9cf86f9be1c401ad155bea86/src/libraries/CapsLibrary.sol#L60-L75

Vulnerability details

After a user attempts lending or borrowing, the function CapsLibrary.validateVariablePoolHasEnoughLiquidity() is called to ensure the Aave pool has enough liquidity for the current borrower to withdraw USDC. However, it checks the wrong address and reverts.

Impact

No user can utilize the lending or borrowing functions until the contracts are upgraded to fix the issue.
No financial loss incurred to user.

Proof of Concept

In SizeStorage, the configuration variablePool points to the AAVE V3 main pool (0x87870Bca3F3fD6335C3F4ce8392D69350B4fA4E2), which hold tokens.

When CapsLibrary tries to get the underlyingBorrowToken (USDC) balance of variablePool, it always returns 0, as shown below:

    function validateVariablePoolHasEnoughLiquidity(State storage state, uint256 amount) public view {/
        uint256 liquidity = state.data.underlyingBorrowToken.balanceOf(address(state.data.variablePool));//@get USDC balance of aave pool
        if (liquidity < amount) {
            revert Errors.NOT_ENOUGH_BORROW_ATOKEN_LIQUIDITY(liquidity, amount);
        }//@audit H did query state query wrong pool here? state.data.variablePool is main aave Pool. it does not hold any token.
    }

This function is supposed to point to the Aave pool pair ETH/USDC, as seen in DepositTokenLibrary.sol:
https://github.com/code-423n4/2024-06-size/blob/8850e25fb088898e9cf86f9be1c401ad155bea86/src/libraries/DepositTokenLibrary.sol#L55-L56

Because aEthUSDC contract holds the actual USDC for user withdrawals, not the main pool.

Tools Used

Recommended Mitigation Steps

Point to correct address

    function validateVariablePoolHasEnoughLiquidity(State storage state, uint256 amount) public view {
        // uint256 liquidity = state.data.underlyingBorrowToken.balanceOf(address(state.data.variablePool));//@USDC balance
        //fixed to working with fork test
        address aToken = state.data.variablePool.getReserveData(address(state.data.underlyingBorrowToken)).aTokenAddress;
        uint256 liquidity = state.data.underlyingBorrowToken.balanceOf(aToken);//@USDC balance
        if (liquidity < amount) {
            revert Errors.NOT_ENOUGH_BORROW_ATOKEN_LIQUIDITY(liquidity, amount);
        }
    }

Assessed type

Error

[C4-Staff]

CloudEllie marked the issue as duplicate of #218

[c4-judge]

hansfriese changed the severity to 3 (High Risk)

[c4-judge]

hansfriese marked the issue as satisfactory

[c4-judge]

hansfriese changed the severity to 2 (Med Risk)