Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

LiquidationFinalized will always incorrectly return 0 as amount of liquidated collateral

meeve

Summary

After sucessful liqudation LiquidationFinalized event is emited, which should notify in the last parameter about the liquidated collateral value.

// LendingPool.sol 535
​
emit LiquidationFinalized(stabilityPool, userAddress, userDebt, getUserCollateralValue(userAddress));

but this will always return 0, since user was already liquidated and doesn't have any collateral.

Vulnerability Details

During the liqudation, all users NFTs are transfered to stabilityPool, and the user.nftTokenIds is deleted.

// LendingPool.sol 496
​
function finalizeLiquidation(address userAddress) external nonReentrant onlyStabilityPool {
// ...some_code
delete user.nftTokenIds;
​
// ...some_code
emit LiquidationFinalized(stabilityPool, userAddress, userDebt, getUserCollateralValue(userAddress));
}

However, in the definition of the getUserCollateralValue function, we see that it uses the same array to calculate the total collateral of the user. (And this array is already empty at that point)

// LendingPool.sol 561
​
function getUserCollateralValue(address userAddress) public view returns (uint256) {
UserData storage user = userData[userAddress];
uint256 totalValue = 0;
​
for (uint256 i = 0; i < user.nftTokenIds.length; i++) {
uint256 tokenId = user.nftTokenIds[i];
uint256 price = getNFTPrice(tokenId);
totalValue += price;
}
​
return totalValue;
}

Impact

LiquidationFinalized always emits 0 as total collateral liqudated. Which provide wrong information, since some value was actually liquidated.

Tools Used

Manual Review

Recommendations

That value should be calculated at the start of liquidation, assigned to variable, and this variable should be emitted at the end

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::finalizeLiquidation emits 0 collateralLiquidated because it deletes the info required to compute it

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.