https://etherscan.io/tx/0xf0919a53bf8bf0c803600919ac5cdcc74b9e5d233476f82ff4ce2ff35785b8e3
gm or gn.
The priority when discovering the bug was to ensure that all X7D minters would be able to withdraw their funds.
Here is an explanation of the intended interaction between the lending pool and the lending pool reserve, and what the bug is.
The expected interaction between the Lending Pool Reserve and the Lending Pool are the following.
Lending Pool Reserve Contract:
- Various inflows to the lending ecosystem result in ETH being deposited on the lending pool reserve contract and X7D being minted. If the ecosystem is the origin of those funds (NFT mints, X7100 fee revenue, splitter allocation, etc.) then the X7D is minted and sent to the token locker. If a user is the origin of those funds, the X7D is minted and sent to the user.
- The owner of the Lending Pool Reserve is permitted to set the Lending Pool address, and to call FundLendingPool. This does not result in any changes to X7D.
Lending Pool Contract:
- The owner of the Lending Pool contract may set the Lending Pool Reserve address.
- The owner of the Lending Pool contract may set any number of "Authorized Capital Managers".
- Authorized Capital Managers may call returnETHToLendingPoolReserve to return any amount of ETH back to the lending pool.
A bug in returnETHToLendingPoolReserve caused that function to be uncallable (namely there is a check that the amount is "greater than" the contract balance - it should have been a "less than or equal to").
The "role" of an Authorized Capital Manager is to ensure that any X7D minters that want to redeem their X7D can do so at all times. In the ecosystem design this would include liquidation of ecosystem owned X7100 tokens, but at present the mechanism for achieving this goal is ensuring managing the flows between the lending pool reserve and lending pool accordingly.
We will utilize a workaround to extract the ETH from the lending pool and return it to the lending pool reserve, and then we can deploy a fixed lending pool contract that is absent the above mentioned bug.
