Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Users cannot deposit more collateral to prevent liquidation

ChainProof

Summary

User can't deposits more NFTs to to close liquidation.

Vulnerability Details

The closeLiquidation allow users to repay debt and close a liquidation of their positions.

function closeLiquidation() external nonReentrant whenNotPaused {
address userAddress = msg.sender;
​
if (!isUnderLiquidation[userAddress]) revert NotUnderLiquidation();
​
// update state
ReserveLibrary.updateReserveState(reserve, rateData);
​
if (block.timestamp > liquidationStartTime[userAddress] + liquidationGracePeriod) {
revert GracePeriodExpired();
}
​
UserData storage user = userData[userAddress];
​
uint256 userDebt = user.scaledDebtBalance.rayMul(reserve.usageIndex);
​
if (userDebt > DUST_THRESHOLD) revert DebtNotZero();
​
isUnderLiquidation[userAddress] = false;
liquidationStartTime[userAddress] = 0;
​
emit LiquidationClosed(userAddress);
}
​

The problem with this is that users can't deposits more nfts in that case to close the liquidation, this is because the closeLiquidation does not take into account the user's collateral value against his borrowed amount but the debt.

More impact of this is that, when users deposits nfts during that period with the intent of closing the liquidation, the nfts cannot be withdrawn due to this and also will not prevent the liquidation even if they should be able to.

Impact

User cant deposit more collateral to close the liquidation, also the collateral deposited cannot be withdrawn

Tools Used

Manual review

Recommendations

Take into account the user's collateral against his borrowed amount, this will ensure that the collateral deposited will prevent liquidation and also not lock the assets.

Updates

Lead Judging Commences

inallhonesty Lead Judge about 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::finalizeLiquidation() never checks if debt is still unhealthy

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.