Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Market Pause Prevents Debt Repayment and Collateral Addition

bshyuunn

01. Relevant GitHub Links

02. Summary

When the contract is paused, users cannot call depositNFT to add collateral or repay to pay off their debt. However, the finalizeLiquidation function remains callable, allowing liquidations to proceed. As a result, once liquidation begins, users have no way to protect themselves if the market is paused.

03. Vulnerability Details

depositNFT and repay both require whenNotPaused

During a pause, new collateral cannot be posted, and debt cannot be repaid.

function depositNFT(uint256 tokenId) external nonReentrant whenNotPaused {
// update state
ReserveLibrary.updateReserveState(reserve, rateData);
​
if (raacNFT.ownerOf(tokenId) != msg.sender) revert NotOwnerOfNFT();
​
UserData storage user = userData[msg.sender];
if (user.depositedNFTs[tokenId]) revert NFTAlreadyDeposited();
​
user.nftTokenIds.push(tokenId);
user.depositedNFTs[tokenId] = true;
​
raacNFT.safeTransferFrom(msg.sender, address(this), tokenId);
​
emit NFTDeposited(msg.sender, tokenId);
}
/**
* @notice Allows a user to repay their own borrowed reserve assets
* @param amount The amount to repay
*/
function repay(
uint256 amount
) external nonReentrant whenNotPaused onlyValidAmount(amount) {
_repay(amount, msg.sender);
}

Even while paused, the finalizeLiquidation function can still be called by the Stability Pool.

/**
* @notice Allows the Stability Pool to finalize the liquidation after the grace period has expired
* @param userAddress The address of the user being liquidated
*/
function finalizeLiquidation(
address userAddress
) external nonReentrant onlyStabilityPool {
if (!isUnderLiquidation[userAddress]) revert NotUnderLiquidation();
​
// update state
ReserveLibrary.updateReserveState(reserve, rateData);

If a user’s liquidation process starts and the market is paused, that user cannot prevent or stop liquidation because they cannot add collateral or repay their debt.

Because finalizeLiquidation remains accessible while the market is paused, users who rely on repaying or adding collateral to avoid liquidation will be unable to do so.

04. Impact

  • Users can be forced into liquidation if the market is paused.

  • No mechanism exists for users to protect themselves by adding collateral or repaying debt during this period.

  • This could lead to unexpected asset loss and liquidation events.

05. Tools Used

Manual Code Review and Foundry

06. Recommended Mitigation

Allow debt repayment and collateral addition (repay and depositNFT) even when the market is paused.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Unfair Liquidation As Repayment / closeLiquidation Paused While Liquidations Enabled

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Unfair Liquidation As Repayment / closeLiquidation Paused While Liquidations Enabled

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!