Core Contracts

Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Submission Details
Severity: high
Valid

Missing NFT Auction Integration After StabilityPool Receives Liquidated Positions

Relevant Context

When a liquidation is finalized in the LendingPool, all NFT positions of the liquidated user are transferred to the StabilityPool contract through the finalizeLiquidation() function. The NFTLiquidator contract exists to handle the auctioning of these liquidated NFTs, but there's currently no integration to initiate this process.

Finding Description

The LendingPool's finalizeLiquidation() function transfers all NFTs from liquidated positions to the StabilityPool. However, the StabilityPool lacks the functionality to initiate the auction process for these received NFTs through the NFTLiquidator contract.

The sequence is:

  1. LendingPool transfers all NFTs to StabilityPool

  2. StabilityPool receives the NFTs but has no mechanism to start their auction process

  3. NFTLiquidator has the auction functionality but is never called

This creates a gap in the liquidation process where NFTs can become stranded in the StabilityPool without a way to recover their value through the intended auction mechanism.

Impact Explanation

High. Without the ability to auction liquidated NFTs, the value of these assets cannot be recovered to offset the bad debt in the system. This could lead to accumulation of non-performing assets in the StabilityPool and impact the protocol's solvency.

Likelihood Explanation

High. This affects every liquidation where NFTs are transferred to the StabilityPool, as there is no implemented mechanism to initiate their auction process.

Proof of Concept

  1. A user's position becomes liquidatable

  2. finalizeLiquidation() is called on the LendingPool

  3. All NFTs are transferred to the StabilityPool (as seen in the code)

  4. The NFTs remain in the StabilityPool with no way to initiate their auction through NFTLiquidator

  5. The value of these NFTs remains locked and unavailable to cover the system's bad debt

Recommendation

Add functionality to the StabilityPool to handle received NFTs by initiating their auction process. Here's a suggested implementation:

// Add NFTLiquidator interface
INFTLiquidator public nftLiquidator;
// Add setter function
function setNFTLiquidator(address _nftLiquidator) external onlyOwner {
nftLiquidator = INFTLiquidator(_nftLiquidator);
}
// Add function to process received NFTs
function processLiquidatedNFTs(uint256[] calldata tokenIds, uint256 totalDebt)
external
onlyManagerOrOwner
nonReentrant
{
for (uint256 i = 0; i < tokenIds.length; i++) {
// Calculate proportional debt for this NFT
uint256 nftDebt = (totalDebt * getNFTValue(tokenIds[i])) / getTotalNFTValue(tokenIds);
// Approve NFT transfer
IERC721(nftContract).approve(address(nftLiquidator), tokenIds[i]);
// Start auction for this NFT
nftLiquidator.liquidateNFT(tokenIds[i], nftDebt);
}
}

This implementation allows managers to initiate the auction process for NFTs received through liquidation, completing the liquidation cycle and enabling value recovery.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Liquidated RAACNFTs are sent to the StabilityPool by LendingPool::finalizeLiquidation where they get stuck

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!