LendingPool: Incorrect Debt-to-Collateral Health Check During WithdrawNFT
Summary
LendingPool: The health check in withdrawNFT function should ensure that the collateral value, adjusted by the liquidation threshold, is greater than or equal to the user’s total debt. However, the current check multiplies the total debt by the liquidation threshold instead of multiplying the collateral value by it, leading to an incorrect evaluation of borrowing eligibility.
Vulnerability Details
withdrawNFT function checks for loan health:
Assume:
-
LiquidationThreshold=80%
-
collateralValue-nftValue = $1000
-
userTotalDebt = $1200
-
The chaeck
1000 < 1200*80%is Falseso It will not revert and user can withdraw NFT and his debt will be more than remaining collateral value!
Impact
The user can withdraw NFT and his debt will be more than their actual collateral value.
Lenders should pay for bad debts and lose money.
Tools Used
vscode
Recommendations
Lead Judging Commences
LendingPool::borrow as well as withdrawNFT() reverses collateralization check, comparing collateral < debt*0.8 instead of collateral*0.8 > debt, allowing 125% borrowing vs intended 80%
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.