runLiquidation() function on LiquidationPoolManager should check if nft id exists before proceeding with function logic
Summary
LiquidationPoolManager does not implement check for nft id passed to it as a function argument.
Vulnerability Details
LiquidationPoolManager does not check if the nft id passed to it even exists or if it has been minted. This will lead to faulty and unexpected behavior. Also, anyone can call this function and congest the network will faulty transactions.
Impact
This will lead to buggy and unexpected behavior since contract is relying on external contract to check for smart vault address and then liquidating the same vault. Relying on smartVaultIndex to supply us with the correct address is not sufficient in ensuring the right vault is liquidated.
Tools Used
Manual review
Recommendations
Check if nft id exists before proceeding with contract logic
Lead Judging Commences
informational/invalid
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.