[H-06] RAACNFTs are stuck in StabilityPool after a successful liquidation
Summary
After a successful liquidation the RAACNFTs that were deposited by the user in the LendingPool will be sent to the StabilityPool without any way to get them out.
Vulnerability Details
There is no function to handle the withdrawal of NFTs from the StabilityPool in its contract, furthermore the transfer is not performed with the "safe" variant of the transfer function, further lacking any handling of the issue.
Impact
The NFT tokens are stuck in the StabilityPool instead of being auctioned off to compensate for the losses of the protocol.
Tools Used
Manual review.
Recommendations
Implement additional functionality to handle these tokens, even if just an "emergency" withdrawal.
Lead Judging Commences
Liquidated RAACNFTs are sent to the StabilityPool by LendingPool::finalizeLiquidation where they get stuck
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.