Resupply CurveLend Operator

The reduceAmount() function can be used to withdraw an arbitrary amount of assets from the market permissionlessly. The implementation refunds the factory only the difference with respect to the limit, and then returns any leftovers to the vault.

This withdrawal and redeposit cycle could have a negative impact on the operator's assets if the vault implements entry and/or exit fees, or due to rounding issues during share conversion, depending on the attacker's capacity to inflate share value.

Low.

Validate the reduction amount is within the intended difference (i.e., amount <= mintedAmount - mintLimit).

Fixed in commit 002d863414af4c63f9b48e58d196049af91099dc.

The implementation utilizes convertToAssets() to calculate the total assets held, which may not accurately reflect the actual effects of a share redemption.

CurveLendMinterFactory.sol#L24.
CurveLendOperator#L110.

Informational.

Change convertToAssets() for previewRedeem().

Fixed in commit 002d863414af4c63f9b48e58d196049af91099dc.

When removing or replacing a market operator through addMarketOperator() or removeMarketOperator() the operator then needs to be called manually, once to reset the mint limit back to 0 through setMintLimit(), then to reimburse borrowed funds through reduceAmount() and finally withdraw_profit() to remove profits.

While this could batched through a script and gnosis safe interface, it might be easier and less prone to errors to directly update the functions.

To simplify DAO operations during operator removal/replacement, consider adding a bool shutdown parameter to addMarketOperator() and removeMarketOperator(), if set to true then call setMintLimit(0), reduceAmount(mintedAmount()) and withdraw_profit() on the operator.

Inside the operator contract, consider allowing setMintLimit() to be called by the factory and not only the owner.

Informational.

Implement the suggested changes.

Acknowledged.