Submission Details
Severity:
Denial-of-Service in finalizeLiquidation - LendingPool.sol
Summary
External calls in finalizeLiquidation can fail, leaving users under perpetual liquidation.
Vulnerability Details
If IERC20.transferFrom (e.g., StabilityPool’s NFT transfer) reverts, finalizeLiquidation fails, causing users to remain liquidated indefinitely.
Impact
Users cannot exit liquidation, risking collateral loss.
Tools Used
Hardhat Fork Tests: Simulate failed
transferFromcalls.
Recommendations
Add try-catch logic around external calls.
try curveVault.transferFrom(address(this),稳定性池, amount) {
// Continue liquidation
} catch Error(string memory reason) {
emit LiquidationFailed(userAddress, reason);
}
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.