Submitted by minhquanym, also found by oakcobalt and bin2chen
In the Pool contract, undeployed funds could be deposited to Aave or Lido to earn base yield. When an offer of Pool is accepted from MultiSourceLoan, the function validateOffer() is called to validate the terms and also to pull the undeployed funds back in case the contract balance is insufficient.
However, the input params of reallocate() are incorrect, resulting in the contract balance might still be insufficient for the loan after calling the function.
Consider the scenario:
Call reallocate(0, principalAmount - currentBalance, true) instead.
0xA5DF (judge) decreased severity to Medium and commented:
0xend (Gondi) confirmed and commented:
Gondi mitigated:
Status: Mitigation confirmed. Full details in reports from oakcobalt, minhquanym and bin2chen.
