Liquidated RAACNFTs are stuck in StabilityPool
Summary
When users are liquidated, their collateral, in the form of a RAACNFT will be transferred from the LendingPool to the StabilityPool.
However, the StabilityPool does not have any functions exposed to transfer the RAACNFT to another address.
Vulnerability Details
-
In the
finalizeLiquidation()function in theLendingPool, theRAACNFTsthat were used as the colateral for the user is transferred as such. -
Once the
RAACNFTsare in theStabilityPool, there is no way for transfer them out for resale.
Impact
RAACNFTs used as collateral will be stuck in StabilityPool.
Tools Used
Manual Review
Recommendations
Expose a onlyOwner function to transfer the NFT to an address of choice.
Lead Judging Commences
Liquidated RAACNFTs are sent to the StabilityPool by LendingPool::finalizeLiquidation where they get stuck
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.