Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

A user's nfts can be frozen to protocol when he deposits too many nfts.

danielarmstrong

Summary

A user's nfts can be frozen to protocol when he deposits too many nfts.

Vulnerability Details

LendingPool.sol#depositNFT() function is as follows.

function depositNFT(uint256 tokenId) external nonReentrant whenNotPaused {
// update state
ReserveLibrary.updateReserveState(reserve, rateData);
​
if (raacNFT.ownerOf(tokenId) != msg.sender) revert NotOwnerOfNFT();
​
UserData storage user = userData[msg.sender];
if (user.depositedNFTs[tokenId]) revert NFTAlreadyDeposited();
​
​
user.nftTokenIds.push(tokenId);
user.depositedNFTs[tokenId] = true;
​
raacNFT.safeTransferFrom(msg.sender, address(this), tokenId);
​
​
emit NFTDeposited(msg.sender, tokenId);
}

As we can see above, maximum count of user's nfts is not limited.
So following LendingPool.sol#getUserCollateralValue() function can be always reverted because of too big count of nfts array.

function getUserCollateralValue(address userAddress) public view returns (uint256) {
UserData storage user = userData[userAddress];
uint256 totalValue = 0;
​
for (uint256 i = 0; i < user.nftTokenIds.length; i++) {
uint256 tokenId = user.nftTokenIds[i];
uint256 price = getNFTPrice(tokenId);
totalValue += price;
}
​
return totalValue;
}

Therefore, critical user's call such as withdrawNFT(), borrow(), initiateLiquidation() function is reverted.

Impact

Then, user's collateral is frozen to protocol.

Tools Used

Mannual review

Recommendations

Add a check that the count of user's nfts does not exceed maximum count.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Design choice
Assigned finding tags:

LendingPool: Unbounded NFT array iteration in collateral valuation functions creates DoS risk, potentially blocking liquidations and critical operations

LightChaser L-36 and M-02 covers it.

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Design choice
Assigned finding tags:

LendingPool: Unbounded NFT array iteration in collateral valuation functions creates DoS risk, potentially blocking liquidations and critical operations

LightChaser L-36 and M-02 covers it.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!