There is no practical way to get the real value out of the liquidated `RAACNFT` in the `StabilityPool`
Summary
This happens due to absence of connection with the `NFTLiquidator` contract
Vulnerability Details
When a user mints himself a RAACNFT, he transfers the corresponding token to the contract in exchange for the NFT. The problem here is that once user gets the NFT, the funds are practically stuck in the RAACNFT contract with no way to get them out of there. This goes the same for StabilityPool . When an NFT is liquidated it goes to the StabilityPool, where it is practically stuck with no way to extract value out of it.
Impact
This vulnerability leads to stuck funds in the RAACNFT contract with no way for neither the protocol nor the users to get funds back from it
Tools Used
Manual Review
Recommendations
Implement a function in the StabilityPool contract that allows the users and the protocol to burn those NFTs in exchange for the corresponding amount of crvUSD
Lead Judging Commences
Liquidated RAACNFTs are sent to the StabilityPool by LendingPool::finalizeLiquidation where they get stuck
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.