Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Partial Repayments Lost Alongside Full Collateral Seizure During Liquidation

DRUGstore

Summary

The protocol's liquidation mechanism actively discourages users from making partial repayments during defaults, worsening protocol liquidity risks & increasing bad debt.

When a user repays part of their debt during liquidation, the protocol retains both the partial repayment amount and all NFT collateral, leaving users with no benefit from their repayment efforts.

Vulnerability Details

When users partially repay debt via `_repay()` but fail to fully clear it before liquidation finalization,the liquidation process unjustly confiscates both partial repayments and full collateral.

// Scenario:
// - User debt: 10 ETH
// - Partial repayment: 3 ETH via _repay()
// - Remaining debt: 7 ETH
// - Liquidation finalizes,StabilityPool pays remaining 7 ETH debt + confiscates all user NFTs
// Result: User loses 3 ETH (repayment) + all NFTs (collateral)

The root cause is:

  • No tracking of partial repayments (`user.scaledDebtBalance` reduction ≠ credit tracking)

  • finalizeLiquidation seizes collateral without refunding partial repayments.

function _repay(uint256 amount, address onBehalfOf) internal {
//...
​
reserve.totalUsage = newTotalSupply;
user.scaledDebtBalance -= amountBurned;
//rest of the code...
​
emit Repay(msg.sender, onBehalfOf, actualRepayAmount);
}
function finalizeLiquidation(
address userAddress
) external nonReentrant onlyStabilityPool {
//...
​
// Update user's scaled debt balance
user.scaledDebtBalance -= amountBurned; //@audit only the remaining debt is paid off after the nft is liquidated, the user loses the partial repayment they made which is not kept track off at all
reserve.totalUsage = newTotalSupply;
​
// rest of the code...
​
emit LiquidationFinalized(.....);
}

Impact

Users suffer double financial loss:

  • Irrecoverable partial repayments

  • Full collateral seizure

Severity: High

  • Financial Harm: Direct asset loss to users

  • Systemic Effect: Discourages partial repayments → Increased bad debt

  • Protocol Reputation Risk: Erodes user trust in fair treatment

Users lose their partial repayment amounts with no compensation for the payment they made. All NFT collateral is forfeited regardless of owed amount.

Tools Used

Manual review

Recommendations

  • Implement a repayment credit system:

    1. Track partial repayments in a `partialRepaymentCredits` mapping

    2. Refund credits during liquidation finalization:

Updates

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::finalizeLiquidation() never checks if debt is still unhealthy

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.