Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

LendingPool: Incorrect Debt-to-Collateral Health Check During Borrowing

ace_30

Summary

LendingPool: The health check in borrow function should ensure that the collateral value, adjusted by the liquidation threshold, is greater than or equal to the user’s total debt. However, the current check multiplies the total debt by the liquidation threshold instead of multiplying the collateral value by it, leading to an incorrect evaluation of borrowing eligibility.

Vulnerability Details

in borrow function it checks for loan health:

// Ensure the user has enough collateral to cover the new debt
if (collateralValue < userTotalDebt.percentMul(liquidationThreshold)) {
revert NotEnoughCollateralToBorrow();
}

Assume:

  • LiquidationThreshold=80%

  • collateralValue = $1000

  • userTotalDebt = $1200

  • The chaeck 1000 < 1200*80% is False

    so It will not revert and user can borrow more than his collateral value

Impact

The user can borrow more than their actual collateral value and never repays the loan

Tools Used

vscode

Recommendations

if (collateralValue.percentMul(liquidationThreshold) < userTotalDebt) {
revert NotEnoughCollateralToBorrow();
}
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::borrow as well as withdrawNFT() reverses collateralization check, comparing collateral < debt*0.8 instead of collateral*0.8 > debt, allowing 125% borrowing vs intended 80%

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.