Core Contracts

Summary

The StabilityPool contract lacks the necessary implementation to receive and handle NFTs during liquidation, despite being the designated recipient of NFTs in the LendingPool's liquidation process. This mismatch can cause liquidations to fail and potentially lock NFTs in the LendingPool.

Vulnerability Details

Source

• LendingPool.sol#L517

• [StabilityPool.sol])

The LendingPool attempts to transfer NFTs to the StabilityPool during liquidation:

However, the StabilityPool contract:

1. Does not implement ERC721Holder

2. Has no functionality to handle or manage received NFTs

3. Lacks methods to distribute or auction liquidated NFTs

Proof of Concept

1. A user's position in LendingPool becomes liquidatable

2. The StabilityPool try liquidation through finalizeLiquidation

3. LendingPool attempts to transfer NFTs to StabilityPool

4. The transfer fails because StabilityPool cannot receive ERC721 tokens

5. The entire liquidation transaction reverts

6. The liquidation cannot be completed, potentially leaving bad debt in the system

Impact

• Liquidations involving NFTs will fail

• System cannot handle underwater positions properly

• NFTs could potentially become locked in the LendingPool

• Stability mechanism of the protocol is compromised

Tools Used

• Manual code review

Recommendations

1. Implement ERC721 receiver functionality in StabilityPool: