caventa - Asset manager's deposit, withdraw and rebalance function calls will get reverted when one of the adapters is broken or paused

[sherlock-admin]

caventa

medium

Asset manager's deposit, withdraw and rebalance function calls will get reverted when one of the adapters is broken or paused

Summary

Asset manager's deposit, withdraw and rebalance function calls will get reverted when one of the adapters is broken or paused.

Vulnerability Detail

A given MoneyMarketAdapters can temporally or even permanently becomes malfunctioning (cannot deposit/withdraw) for all sorts of reasons. This results in all the other deposit, withdraw and rebalance calls to other adapters getting reverted.

Eg, Aave V2 Lending Pool can be paused, which will prevent multiple core functions that the Aave v2 depends on from working, including deposit() and withdraw().

Impact

When Aave V2 Lending Pool is paused, deposit, withdraw, and rebalance function calls on other adapters will get reverted.

Code Snippet

https://github.com/sherlock-audit/2022-10-union-finance/blob/main/union-v2-contracts/contracts/asset/AssetManager.sol#L290
https://github.com/sherlock-audit/2022-10-union-finance/blob/main/union-v2-contracts/contracts/asset/AssetManager.sol#L307
https://github.com/sherlock-audit/2022-10-union-finance/blob/main/union-v2-contracts/contracts/asset/AssetManager.sol#L529
https://github.com/sherlock-audit/2022-10-union-finance/blob/main/union-v2-contracts/contracts/asset/AssetManager.sol#L537
https://github.com/sherlock-audit/2022-10-union-finance/blob/main/union-v2-contracts/contracts/asset/AssetManager.sol#L357
https://github.com/sherlock-audit/2022-10-union-finance/blob/main/union-v2-contracts/contracts/asset/AssetManager.sol#L514

Tool used

Manual Review

Recommendation

Consider adding a try-catch clause to every code snippet written above so that when the pool is paused in AaveV2, deposit, withdrawal, and rebalance function calls are still allowed on other adapters.

For eg (For AssetManager.sol#L357) :

try moneyMarket.withdraw(token, account, withdrawAmount) {
 // Code added when there is no exception thrown
} catch {
// Code added when there is an exception thrown
}

[GeraldHost]

unioncredit/union-v2-contracts#71