Core Contracts

Summary

The borrow() and withdrawNFT() function incorrectly calculates the collateral-to-debt ratio, causing malicious borrowing attempts to over**-collateralized positions to be accepted**.

Vulnerability Details

The liquidation threshold is defined as:

However, the condition for borrowing:

This is mathematically incorrect, leading to incorrect liquidation risk evaluations.

Exploit Scenario

Assume: Collateral Value = 100 ETH, Debt Requested = 0 ETH, Liquidation Threshold = 80% (8000 in basis points)

Expected correct condition: 100 ETH * 8000 / 10000 = 80 ETH, So max borrow is 80 ETH.

But in fact, 100 ETH < 120 ETH * 8000 / 10000 = 96 ETH, False will lead to borrow can be allowed for 120 ETH.

This wrong logic is implied in withdrawNFT().

Proof Of Code

Testcode is written in LendingPool.test.js

POC shows that NFT Price is only 100 ETH, but user1 can borrow 120 ETH.

Impact

Borrow is allowed even with insufficient collateral.

Protocol will lose funds.

Tools Used

manual

Recommendations

Fix the borrowing condition. Be cautious with liquidation value can be 0 and userTotalDebt = 0, so >= must be correct.