Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

LendingPool::withdrawNFT() Does Not Consider User Deposits in Collateral Calculation

josh4324

Summary

The withdrawNFT() function allows users to withdraw their NFTs from the protocol only if their remaining collateral (NFTs) is sufficient to cover their outstanding debt. However, the function only considers NFTs as collateral and does not include the user’s token deposits in the lending pool.

This means a user who has deposited crvUSD tokens as collateral could be incorrectly blocked from withdrawing their NFT, even if they still have enough collateral in the pool.

Vulnerability Details

function withdrawNFT(uint256 tokenId) external nonReentrant whenNotPaused {
if (isUnderLiquidation[msg.sender]) revert CannotWithdrawUnderLiquidation();
​
UserData storage user = userData[msg.sender];
if (!user.depositedNFTs[tokenId]) revert NFTNotDeposited();
​
// update state
ReserveLibrary.updateReserveState(reserve, rateData);
​
// Check if withdrawal would leave user undercollateralized
uint256 userDebt = user.scaledDebtBalance.rayMul(reserve.usageIndex);
uint256 collateralValue = getUserCollateralValue(msg.sender);
uint256 nftValue = getNFTPrice(tokenId);
​
if (collateralValue - nftValue < userDebt.percentMul(liquidationThreshold)) {
revert WithdrawalWouldLeaveUserUnderCollateralized();
}
​
// Remove NFT from user's deposited NFTs
for (uint256 i = 0; i < user.nftTokenIds.length; i++) {
if (user.nftTokenIds[i] == tokenId) {
user.nftTokenIds[i] = user.nftTokenIds[user.nftTokenIds.length - 1];
user.nftTokenIds.pop();
break;
}
}
user.depositedNFTs[tokenId] = false;
​
raacNFT.safeTransferFrom(address(this), msg.sender, tokenId);
​
emit NFTWithdrawn(msg.sender, tokenId);
}
​

The function only considers NFT collateral by using getUserCollateralValue(msg.sender), which excludes any crvUSD deposits that could also be used as collateral.

If a user has deposited crvUSD tokens into the lending pool but has no additional NFTs, the function may incorrectly block NFT withdrawals even if the user remains overcollateralized.

User deposits should also be considered when evaluating whether an NFT withdrawal leaves a user undercollateralized.

Impact

The function does not include crvUSD deposits, leading to incorrect withdrawal rejections.

Tools Used

Manual Review

Recommendations

Include User Deposits in Collateral Calculation

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Design choice
inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.