Assessment reports>Aura Finance>Discussion>Withdrawal of funds from a shut down pool

Withdrawal of funds from a shut down pool

During the execution of the shutdownPool function, tokens are withdrawn from the gauge contract and transferred to the address of the current contract. But since try/catch is used, the pool will be successfully shut down even if the funds have not been withdrawn. The withdrawn tokens can be received by users using the withdraw function. The function withdraws tokens from the staker contract if the pool is not shut down; otherwise, tokens are transferred from the current contract balance.

If the tokens were not withdrawn during the shutdown, there are two possible options. Firstly, a second attempt to withdraw funds will not be possible and users will not be able to receive tokens if the balance of the contract is empty. Secondly, even if the contract owns lptoken tokens, users can receive other users' tokens, for example, withdrawn from the previous pool that was shut down with the same lptoken but not yet withdrawn by depositors.

Therefore, shutting down the pool without guaranteed receipt of the lptoken tokens by the contract may lead to problems when withdrawing funds by users.

function shutdownPool(uint256 _pid) external nonReentrant returns(bool){
    require(msg.sender==poolManager, "!auth");
    PoolInfo storage pool = poolInfo[_pid];

    //withdraw from gauge
    try IStaker(staker).withdrawAll(pool.lptoken,pool.gauge){
    }catch{}

    pool.shutdown = true;
    gaugeMap[pool.gauge] = false;

    emit PoolShutdown(_pid);
    return true;
}

function withdraw(uint256 _pid, uint256 _amount) public returns(bool){
    _withdraw(_pid,_amount,msg.sender,msg.sender);
    return true;
}

function _withdraw(uint256 _pid, uint256 _amount, address _from, address _to) internal nonReentrant {
    ...    
    if (!pool.shutdown) {
        IStaker(staker).withdraw(lptoken,gauge, _amount);
    }
    ...
    //return lp tokens
    IERC20(lptoken).safeTransfer(_to, _amount);
    ...
}
Zellic © 2024Back to top ↑