User deposits in stability pool can be permanently lost.
Summary
User deposit RToken to stability pool to facilitate liquidation and receive reward for doing it. But because liquidated RAACNft is never sold, the user will lose their deposit.
Vulnerability details
when the stability pool calls liquidateBorrower some RToken from user deposits is used to repay the loan in exchange for RAACNft. This NFT is stuck in the stability pool, because of this the user’s deposit is permanently lost.
Ideally, the contract should sell this NFT for RToken and deposit it back to the stability pool for user to withdraw but that is not happening leading to the high severity bug.
Impact
RAACNft is locked in stability pool and user cannot withdraw their deposited RToken if it got used for liquidation.
Recommendation
Implement a way to sell this RAACNFT for RToken and make sure that contract have enough RToken to cover for user’s withdraw.
Lead Judging Commences
Liquidated RAACNFTs are sent to the StabilityPool by LendingPool::finalizeLiquidation where they get stuck
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.