Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Malicious user can prevent liquidation

0xgh0st

Summary

initiateLiquidation function allows anyone to initiate the liquidation process if a user's health factor is below threshold, but to calculate collateral value it iterate over an unbounded array user.nftTokenIds which can be exploited and make it run out of gas.

Vulnerability Details

  • the process of initiating liquidation start by checking health factor and to do that contract iterate over user.nftTokenIds to gets the total collateral value of a user

  • Due to the limit of gas imposed in every block, the contract can run out of gas.

function getUserCollateralValue(address userAddress) public view returns (uint256) {
UserData storage user = userData[userAddress];
uint256 totalValue = 0;
​
for (uint256 i = 0; i < user.nftTokenIds.length; i++) {
uint256 tokenId = user.nftTokenIds[i];
uint256 price = getNFTPrice(tokenId);
totalValue += price;
}
​
return totalValue;
}

  • As we can see depositNFT allows users to NFT tokens with an unbounded amount. Specifically, the function does not impose a hard cap on the number of elements.

function depositNFT(uint256 tokenId) external nonReentrant whenNotPaused {
// update state
ReserveLibrary.updateReserveState(reserve, rateData);
​
if (raacNFT.ownerOf(tokenId) != msg.sender) revert NotOwnerOfNFT();
​
UserData storage user = userData[msg.sender];
if (user.depositedNFTs[tokenId]) revert NFTAlreadyDeposited();
​
​
user.nftTokenIds.push(tokenId);
user.depositedNFTs[tokenId] = true;
​
raacNFT.safeTransferFrom(msg.sender, address(this), tokenId);
​
​
emit NFTDeposited(msg.sender, tokenId);
}

Impact

  • As a consequence, an user.nftTokenIds array with a large number of elements can lead to service disruption. This is due to the fact that the getUserCollateralValue function iterate over the unbounded user.nftTokenIds array, which depending on the amount of elements, can lead to unexpected out-of-gas errors.

  • Even if the issue remains unexploited by attackers, normal users may inadvertently cause NFTs to become stuck in the contract. This occurs when users deposit a large number of tokens and later attempt to withdraw them, as the withdrawNFT function iterates over the entire user.nftTokenIds array, potentially exceeding gas limits and halting the transaction.

Tools Used

Manual audit

Recommendations

the best way to prevent dos attacker is to impose a hard cap on the number of elements.

Updates

Lead Judging Commences

inallhonesty Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Design choice
Assigned finding tags:

LendingPool: Unbounded NFT array iteration in collateral valuation functions creates DoS risk, potentially blocking liquidations and critical operations

LightChaser L-36 and M-02 covers it.

inallhonesty Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Design choice
Assigned finding tags:

LendingPool: Unbounded NFT array iteration in collateral valuation functions creates DoS risk, potentially blocking liquidations and critical operations

LightChaser L-36 and M-02 covers it.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.