Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Missing allocation update for managers during liquidation in StabilityPool contract.

tadev

Summary

The stability pool contains in its storage multiple variables to track managers and their respective allocations. The owner can add and remove managers, and update their allocations for performing liquidations.

The problem arises because liquidateBorrower function doesn't check who is msg.sender in order to update allocation:

function liquidateBorrower(address userAddress) external onlyManagerOrOwner nonReentrant whenNotPaused {
_update();
// Get the user's debt from the LendingPool.
uint256 userDebt = lendingPool.getUserDebt(userAddress);
uint256 scaledUserDebt = WadRayMath.rayMul(userDebt, lendingPool.getNormalizedDebt());
​
if (userDebt == 0) revert InvalidAmount();
​
uint256 crvUSDBalance = crvUSDToken.balanceOf(address(this));
if (crvUSDBalance < scaledUserDebt) revert InsufficientBalance();
​
// Approve the LendingPool to transfer the debt amount
bool approveSuccess = crvUSDToken.approve(address(lendingPool), scaledUserDebt);
if (!approveSuccess) revert ApprovalFailed();
// Update lending pool state before liquidation
lendingPool.updateState();
​
// Call finalizeLiquidation on LendingPool
lendingPool.finalizeLiquidation(userAddress);
​
// @audit MEDIUM: no manager allocation update during liquidation
​
emit BorrowerLiquidated(userAddress, scaledUserDebt);
}

liquidateBorrower can only be called by the owner or a manager. If it is called by a manager, the corresponding allocation should be updated, as well as totalAllocation.

Impact

The impact of this issue is medium as it leads to incorrect internal accounting, allowing managers to liquidate more than they are authorised.

Tools Used

Manual review

Recommendations

Modify the liquidateBorrower function to make sure manager allocations are correctly tracked.

Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.