Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Potential Denial of Service During Liquidation via Unbounded NFT Array Iteration

kvltbyte

Summary

The LendingPool contract risks a DoS during liquidation. Unbounded iteration in NFT processing can exceed gas limits and block liquidation.

Vulnerability Details

Affected Code

LendingPool::getUserCollateralValue
Used during collateral checks in liquidation:

function getUserCollateralValue(address userAddress) public view returns (uint256) {
@>1 UserData storage user = userData[userAddress];
@>2 uint256 totalValue = 0;
@>3 for (uint256 i = 0; i < user.nftTokenIds.length; i++) {
@>4 uint256 tokenId = user.nftTokenIds[i];
@>5 uint256 price = getNFTPrice(tokenId);
@>6 totalValue += price;
}
@>7 return totalValue;
}

LendingPool::finalizeLiquidation
Iterates over NFTs during liquidation:

for (uint256 i = 0; i < user.nftTokenIds.length; i++) {
@>X uint256 tokenId = user.nftTokenIds[i];
@>Y user.depositedNFTs[tokenId] = false;
@>Z raacNFT.transferFrom(address(this), stabilityPool, tokenId);
}
delete user.nftTokenIds

Issue:
An attacker can mint and deposit many low-valued NFTs. The resulting large NFT array may cause gas exhaustion in these loops during liquidation.

Impact

Liquidation failures may leave the system undercollateralized.

Tools Used

  • Manual code review

Recommendations

  • Limit the number of NFTs a user can deposit.

  • Implement batch processing for NFT iteration.

Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Design choice
Assigned finding tags:

LendingPool: Unbounded NFT array iteration in collateral valuation functions creates DoS risk, potentially blocking liquidations and critical operations

LightChaser L-36 and M-02 covers it.

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Design choice
Assigned finding tags:

LendingPool: Unbounded NFT array iteration in collateral valuation functions creates DoS risk, potentially blocking liquidations and critical operations

LightChaser L-36 and M-02 covers it.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.