Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Liquidations will permanently lock RAACNfts in `StabilityPool`

alexczm

Summary

Liquidations will transfer collateral NFTs to StabilityPool contract. This contract doesn't implement any logic to handle ERC721 tokens, permanently locking all tokens it receives.

Vulnerability Details

StabilityPool inherits from the following contracts: IStabilityPool, Initializable, ReentrancyGuard, OwnableUpgradeable, PausableUpgradeable

contract StabilityPool is IStabilityPool, Initializable, ReentrancyGuard, OwnableUpgradeable, PausableUpgradeable {

None of these contracts nor the StabilityPool implements any logic allowing the NFT transfer.

When a borrow position is liquidated all borrower's NFTs used as collateral are transferred to StabilityPool:

function finalizeLiquidation(address userAddress) external nonReentrant onlyStabilityPool {
if (!isUnderLiquidation[userAddress]) revert NotUnderLiquidation();
​
// update state
ReserveLibrary.updateReserveState(reserve, rateData);
​
if (block.timestamp <= liquidationStartTime[userAddress] + liquidationGracePeriod) {
revert GracePeriodNotExpired();
}
​
UserData storage user = userData[userAddress];
​
uint256 userDebt = user.scaledDebtBalance.rayMul(reserve.usageIndex);
​
isUnderLiquidation[userAddress] = false;
liquidationStartTime[userAddress] = 0;
// Transfer NFTs to Stability Pool
for (uint256 i = 0; i < user.nftTokenIds.length; i++) {
uint256 tokenId = user.nftTokenIds[i];
user.depositedNFTs[tokenId] = false;
@> raacNFT.transferFrom(address(this), stabilityPool, tokenId);
}
delete user.nftTokenIds;

All ERC721 tokens are permanently locked in StabilityPool.

Impact

All ERC721 tokens are permanently locked in StabilityPool.

Tools Used

Recommendations

  • use ERC721.safeTransferFrom when transferring tokens to StabilityPool;

  • StabilityPool to inherit ERC721Holder

  • implement function to handle ERC721 tokens.

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Liquidated RAACNFTs are sent to the StabilityPool by LendingPool::finalizeLiquidation where they get stuck

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.