Core Contracts

Description & Impact

Functions like withdrawNFT() and borrow() call getUserCollateralValue() --> getNFTPrice() which fetches the price from oracle via priceOracle.getLatestPrice(). This can result in situations like:

1. User deposits NFT as collateral at some price

2. Calls borrow() hoping to have health factor of 75% which is below liquidation ratio of 80%

3. Tx remains in the mempool for some time during which NFT price dips

4. Tx finally goes through but borrow amount is dangerously close to 80%, for e.g. 79.99%

5. Immediately in the next block, it touches 80% and becomes eligible for liquidation.

Similarly, while withdrawing NFT, the tx may get delayed in execution and user can receive a bad price.

Mitigation

Allow user to specify either the minCollateralRatio or minNFTPriceAtBorrow inside borrow(). Similarly allow passing minNFTPrice inside withdrawNFT(). Additionally, allow the user to set a deadline.