Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect check will lead to undercollateralized accounts

s4muraii77

Summary

Incorrect check will lead to undercollateralized accounts

Vulnerability Details

Upon a user calling LendingPool::withdrawNFT() which essentially withdraws collateral, we have the following check to determine whether he is leaving himself undercollateralized:

if (collateralValue - nftValue < userDebt.percentMul(liquidationThreshold)) {
revert WithdrawalWouldLeaveUserUnderCollateralized();
}

The liquidationThreshold is a value under 100%, initially set to 80% during the initialization of the contract. This leads to a completely incorrect result as we are reducing the debt by 20% in the above check.

Let's imagine the scenario with some numbers:

  • user's collateral is 100$ and user's debt is 120$, he is clearly undercollateralized

  • the check would be 100 < 120 * 0.8 -> 100 < 96 -> false which leads to the check passing successfully

Impact

Severely undercollateralized positions are possible which is detrimental to the protocol

Tools Used

Manual Review

Recommendations

The liquidation threshold percentage must be applied to the collateral

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::borrow as well as withdrawNFT() reverses collateralization check, comparing collateral < debt*0.8 instead of collateral*0.8 > debt, allowing 125% borrowing vs intended 80%

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.