Core Contracts

Summary

The LendingPool.sol contract allows users to deposit NFTs as collateral. During liquidation, the protocol loops through a variable called getUserCollateralValue, which iterates over all NFTs deposited by the user as collateral. A malicious user could exploit this by depositing numerous low-value NFTs, increasing the gas cost of liquidation. This could deter liquidators from initiating liquidations, as the high gas fees could exceed potential profits. This also affects genuine users with large portfolios of low-value NFTs, making withdrawals or liquidations prohibitively expensive.

Vulnerability Details

The vulnerable function getUserCollateralValue is shown below:

The function loops through each NFT to calculate the total value of a borrower's collateral on the platform. The calculateHealthFactor function relies on this to determine the user's liquidation standing:

The vulnerability arises because users can inflate their collateral by depositing a large number of low-value NFTs. This increases the gas cost for looping through each NFT during liquidation, potentially making the liquidation unprofitable due to high transaction costs. This issue also affects genuine users with diversified portfolios, as it would be costly to liquidate or withdraw their assets.

Impact

• High gas costs for users with large numbers of NFTs, making withdrawals or liquidations expensive.

• Unprofitable liquidations, as gas costs could exceed liquidation profits.

• Potential exploitation by malicious users who deliberately inflate transaction costs to avoid liquidation.

Tools Used

Manual Review

Recommendations

1. Optimize Collateral Calculation: Implement a caching mechanism to store and update the total collateral value only when NFTs are added or removed. This would avoid looping through all NFTs each time getUserCollateralValue is called.

Note Current Cost for getUserCollateralValue for Owner with 50 NFTs

1. Each iteration shows a staticcall costing 367 gas.

2. There are 10 iterations displayed. Assuming this pattern holds for 50 NFTs:

   • ( 367 \text{ gas} \times 50 = 18,350 \text{ gas} )

3. Additionally, there's an initial cost of 79387 gas (likely the base cost for the main call).

4. Total cost:
   [
   79387 + 18350 = 97,737
   ]

Therefore, the estimated gas cost for minting 50 NFTs is 97,737 gas.

Summary

• Average Gas Price (last 2 months): ~28 gwei

• Transaction Cost for 97,000 Gas:

  • In ETH: 0.002716 ETH

  • In USD (at $1,800/ETH): **~$4.89 USD**