Case Study: Arbitrum DeFi Lending Vault Audit — Reentrancy Risk and Deposit Redirection Vulnerability

What We Found

The contract is supposed to reject any transaction that sends tokens to or from a zero (invalid) address. The check was written with OR logic instead of AND logic, which means the condition is mathematically always true and never actually blocks anything. An invalid zero address passes through every time.

Why It Matters

Zero-address validation never triggers, allowing deposits and withdrawals to be directed to the zero address and permanently burning tokens with no error or warning.

What Should Be Done

Replace the OR condition with an AND condition in the zero-address check so that the transaction reverts if either the sender or recipient is the zero address.

What We Found

The vault has a function that allows users to approve a token spend and immediately trigger a callback to an external contract in a single transaction. The problem is that the vault's own balance and share records are not updated before the external contract is called. An attacker can write a malicious contract that, when called back, calls into the vault again — draining funds a second time before the first withdrawal is recorded.

Why It Matters

An attacker can chain repeated withdrawals within a single transaction before any balance updates are recorded, draining vault funds far beyond their actual deposit.

What Should Be Done

Apply the checks-effects-interactions pattern: update all internal state before making any external call, and add a reentrancy guard modifier to the approveAndCall function.

What We Found

When a user deposits tokens using the permit signature flow, the function accepts a destination address as a parameter from the caller — not from the original token owner. This means a third party who has obtained a valid permit signature can call this function and send the resulting vault shares to their own wallet instead of the actual token owner's wallet.

Why It Matters

Any holder of a valid permit signature can redirect vault shares issued from another user's deposit to an attacker-controlled address, permanently stealing the deposited value.

What Should Be Done

Remove the caller-controlled to parameter and replace it with msg.sender or, where delegation is genuinely intended, require an explicit on-chain approval from the token owner for the destination address.

What We Found

One single private key controls the most powerful administrative function in the vault: the ability to withdraw funds. There is no second signer required, no time delay, and no emergency pause. If this key is ever lost, stolen, or compromised, all funds in the vault can be drained immediately and irreversibly.

Why It Matters

A single compromised key enables immediate and complete drainage of all user funds held in the vault with no mechanism to pause or recover.

What Should Be Done

Replace the single admin key with a multisig wallet requiring at least 2-of-3 signers for any fund movement, and implement a timelock on administrative withdrawals.