Core Contracts

Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Submission Details
Severity: medium
Valid

Interest accrual while protocol is paused creates unfair liquidation risk

Summary

The protocol's pause mechanism in LendingPool prevents users from taking protective actions while their positions can still become liquidatable through two vectors: (1) rate changes via admin/oracle functions and (2) collateral value depreciation through market movements. When the protocol unpauses, these users can be immediately liquidated without having had any opportunity to protect their positions.

Vulnerability Details

During protocol pause, users' positions can become unsafe through:

1 - Rate changes

function setPrimeRate(uint256 newPrimeRate) external onlyPrimeRateOracle {
@> ReserveLibrary.setPrimeRate(reserve, rateData, newPrimeRate);
}
/**
* @notice Sets the address of the price oracle
* @param newOracle The new price oracle address
*/
function setPrimeRateOracle(address newOracle) external onlyOwner {
@> primeRateOracle = newOracle;
}

2 - Collateral Value Changes:

  • NFT collateral values can decrease due to market conditions

  • Price oracle updates continue reflecting market prices

  • Users cannot add collateral or repay debt due to whenNotPaused modifier

3 - The public updateState function lacks the whenNotPaused modifier, allowing interest accumulation to continue even when the protocol is paused.

While simultaneously:

  • Users cannot repay loans (whenNotPaused)

  • Users cannot add more collateral (whenNotPaused)

  • Users cannot close liquidations (whenNotPaused)

  • Users cannot withdraw their NFTs (whenNotPaused)

This creates a "trapped" scenario where users watch their positions become unsafe without any recourse until the protocol unpauses, at which point they can be immediately liquidated.

Impact

Users can become liquidatable through external factors (market prices) or internal changes (rates) during pause, with no ability to protect their positions.

Tools Used

Manual Review

Recommendations

  • Implement a grace period after unpause so users can have time to manage their positions.

  • Add whenNotPausedto updateState

  • Additionally, allow repayment/closing while the protocol is paused.

Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Unfair Liquidation As Borrow Interest Accumulates While Paused

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Unfair Liquidation As Borrow Interest Accumulates While Paused

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.