Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

[L-01] ILendingPool event LiquidationFinalized will Always emit a wrong value for collateralLiquidated

joro

Summary

On success, the LendingPool::finalizeLiquidation function will emit a LiquidationFinalized event that Always returns 0 for its last input parameter collateralLiquidated, which is wrong.

Vulnerability Details

Currently the LendingPool::finalizeLiquidation function emits the LiquidationFinalized event like this:

emit LiquidationFinalized(stabilityPool, userAddress, userDebt, getUserCollateralValue(userAddress));

This is wrong because on lines 514 through 519 the finalizeLiquidation function already removes the information about the users NFTs, which is used to calculate the collateral value inside the getUserCollateralValue function:

function getUserCollateralValue(address userAddress) public view returns (uint256) {
UserData storage user = userData[userAddress];
uint256 totalValue = 0;
​
for (uint256 i = 0; i < user.nftTokenIds.length; i++) {
uint256 tokenId = user.nftTokenIds[i];
uint256 price = getNFTPrice(tokenId);
totalValue += price;
}
​
return totalValue;
}

this will make the collateralLiquidated parameter inside the event always be zero, since the information about the NFTs for the given user has been deleted already.

Impact

External applications depending on this value and using it will always get wrong data.

  • Impact: Low

  • Likelihood: Always

Tools Used

  • Manual Review

Recommendations

  1. Calculate collateralLiquidated and store it as a variable before the NFT transfer loop and pass this variable as last parameter to the event

  2. Add validation for the event args with .withArgs(owner.address, user1.address, userDebt, collateralLiquidated); inside the unit tests for this case

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::finalizeLiquidation emits 0 collateralLiquidated because it deletes the info required to compute it

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.