Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

LiquidationFinalized event in LendingPool::finalizeLiquidation does not emit the correct values

modey

Summary

getUserCollateralValue(userAddress) is called after user.nftTokenIds has been deleted, making it return wrong value.

Vulnerability Details

According to the event definition, the LiquidationFinalized event is supposed to emit the address of liquidator, the account being liquidated, the debt being repaid and the value of the collateral being liquidated.

For the value of collateral, it makes a call to getUserCollateralValue(userAddress) . This function loops through the array of user.nftTokenIds to determine and return the value. The issue is that the user's array of nftTokenIds is already deleted by this time, which wipes the relevant NFT data.

The delete happens here: https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/pools/LendingPool/LendingPool.sol#L519

And the event is emited after that at this point: https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/pools/LendingPool/LendingPool.sol#L535

Impact

Loss of Trust and Transparency

One of the key purposes of emitting events in smart contracts is to provide transparency and ensure all actions within the contract can be tracked and verified by external observers (like users or dApps). If the wrong event is emitted:

  • Users will be misled, which could result in a lack of trust in the contract or the dApp.

  • The emitted logs may show inaccurate or incorrect information, damaging the overall reliability of the system.

Tools Used

Manual Review

Recommendations

Fetch and store collateral value before deleting user NFT data. Then pass it in to the Emit.

function finalizeLiquidation(address userAddress) external nonReentrant onlyStabilityPool {
if (!isUnderLiquidation[userAddress]) revert NotUnderLiquidation();
​
// update state
ReserveLibrary.updateReserveState(reserve, rateData);
​
if (block.timestamp <= liquidationStartTime[userAddress] + liquidationGracePeriod) {
revert GracePeriodNotExpired();
}
​
UserData storage user = userData[userAddress];
​
uint256 userDebt = user.scaledDebtBalance.rayMul(reserve.usageIndex);
​
isUnderLiquidation[userAddress] = false;
liquidationStartTime[userAddress] = 0;
// Transfer NFTs to Stability Pool
for (uint256 i = 0; i < user.nftTokenIds.length; i++) {
uint256 tokenId = user.nftTokenIds[i];
user.depositedNFTs[tokenId] = false;
raacNFT.transferFrom(address(this), stabilityPool, tokenId);
}
+ uint256 userCollateralValue = getUserCollateralValue(userAddress); // Fetch before deleting
delete user.nftTokenIds;
​
// Burn DebtTokens from the user
(uint256 amountScaled, uint256 newTotalSupply, uint256 amountBurned, uint256 balanceIncrease) = IDebtToken(reserve.reserveDebtTokenAddress).burn(userAddress, userDebt, reserve.usageIndex);
​
// Transfer reserve assets from Stability Pool to cover the debt
IERC20(reserve.reserveAssetAddress).safeTransferFrom(msg.sender, reserve.reserveRTokenAddress, amountScaled);
​
// Update user's scaled debt balance
user.scaledDebtBalance -= amountBurned;
reserve.totalUsage = newTotalSupply;
​
// Update liquidity and interest rates
ReserveLibrary.updateInterestRatesAndLiquidity(reserve, rateData, amountScaled, 0);
​
+ emit LiquidationFinalized(stabilityPool, userAddress, userDebt, userCollateralValue);
- emit LiquidationFinalized(stabilityPool, userAddress, userDebt, getUserCollateralValue(userAddress));
}
​
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::finalizeLiquidation emits 0 collateralLiquidated because it deletes the info required to compute it

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.