Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

NFT withdrawal is possible even when withdrawals are paused

tigerfrake

Summary

The withdrawNFT() function currently does not check the withdrawalsPaused flag, which can lead to unauthorized withdrawals of NFTs even when withdrawals are intended to be restricted.

Vulnerability Details

The withdrawalsPaused flag allow to pause withdrawals within the protocol.

// Allow to pause withdrawals
bool public withdrawalsPaused = false;

This is enforced in functions such as withdraw() that allows a user to withdraw reserve assets by burning RTokens.

if (withdrawalsPaused) revert WithdrawalsArePaused();

However, the absence of this check in the withdrawNFT() function allows users to withdraw NFTs regardless of the current state of withdrawals.

function withdrawNFT(uint256 tokenId) external nonReentrant whenNotPaused {
// @audit-info withdrawalsPaused not checked
if (isUnderLiquidation[msg.sender]) revert CannotWithdrawUnderLiquidation();
---SNIP---
}

The function only checks if the contract is not paused via the whenNotPaused modifier but does not check if withdrawals are paused.
This oversight can be exploited by malicious actors to drain NFTs from the contract.

Impact

If the withdrawalsPaused flag is not enforced, it can result in:

  • Unauthorized withdrawal of NFTs.

Tools Used

Manual Review

Recommendations

Modify the withdrawNFT() function to include a check for the withdrawalsPaused flag before allowing any withdrawals.

function withdrawNFT(uint256 tokenId) external nonReentrant whenNotPaused {
+ // @audit Checked for puse in withdrawaals
+ if (withdrawalsPaused) revert WithdrawalsArePaused();
​
if (isUnderLiquidation[msg.sender]) revert CannotWithdrawUnderLiquidation();
---SNIP---
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.