Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

User's can deposit low-value NFT's in `depositNFT()` function in the `LendingPool.sol` contract

viquetoh

Summary:

The LendingPool contract allows users to deposit NFTs as collateral for borrowing reserve assets. However, there's no check to ensure that the value of the deposited NFTs exceeds a minimum threshold . This could lead to potential issues where a user can deposit low-value NFTs which may not provide sufficient collateral for the borrowed amount.

Vulnerability Details:

https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/pools/LendingPool/LendingPool.sol#L265-L282
function depositNFT(uint256 tokenId) external nonReentrant whenNotPaused {
// update state
ReserveLibrary.updateReserveState(reserve, rateData);
​
if (raacNFT.ownerOf(tokenId) != msg.sender) revert NotOwnerOfNFT();
​
UserData storage user = userData[msg.sender];
if (user.depositedNFTs[tokenId]) revert NFTAlreadyDeposited();
​
user.nftTokenIds.push(tokenId);
user.depositedNFTs[tokenId] = true;
​
raacNFT.safeTransferFrom(msg.sender, address(this), tokenId);
​
emit NFTDeposited(msg.sender, tokenId);
}

The depositNFT function in the LendingPool contract allows user's to deposit NFTs without checking if the value of the NFT exceeds a minimum threshold.
This code doesn't have a check to ensure that the value of the NFT being deposited exceeds the minimum threshhold. This can lead to users depositing low-value NFTs, which may not provide sufficient collateral for the borrowed amount.
If users are allowed to deposit low-value NFTs as collateral, this can cause the protocol to go underwater.

Impact

  1. Users may deposit low-value NFTs which may not provide sufficient collateral for the borrowed amount.

  2. This can increase the risk of potential losses for the protocol.

Tools Used

Manual review

Recommendations

Add a check to the depositNFT function to ensure that the value of the NFT deposited exceeds a minimum threshold.

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.