Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Users can withdraw even if undercollateralized

pyro

Summary

Users can withdraw even if undercollateralized

Vulnerability Details

withdrawNFT allows users to withdraw their NFTs even if they are underwater. The reason for it as we do the wrong equation when checking for if the user passes the liquidation threshold, where we multiply userDebt by 80% and lower it - userDebt.percentMul(liquidationThreshold).

Since we have lowered the user debt it will be easier for the collateral to be more than the debt.

https://github.com/Cyfrin/2025-02-raac/blob/main/contracts/core/pools/LendingPool/LendingPool.sol#L288

function withdrawNFT(uint256 tokenId) external nonReentrant whenNotPaused {
// ...
​
// scaledDebtBalance * usageIndex / 1e27
uint256 userDebt = user.scaledDebtBalance.rayMul(reserve.usageIndex);
​
// for( totalValue += getNFTPrice(tokenId) )
uint256 collateralValue = getUserCollateralValue(msg.sender);
uint256 nftValue = getNFTPrice(tokenId);
​
if (collateralValue - nftValue < userDebt.percentMul(liquidationThreshold)) {
revert WithdrawalWouldLeaveUserUnderCollateralized();
}

Impact

Users can withdraw even if undercollateralized
System will be insolvent
Users can borrow and then withdraw their NFTs when undercollateralized and then sell them for profit

Tools Used

Manual review

Recommendations

move the multiplication to the other side

- if (collateralValue - nftValue < userDebt.percentMul(liquidationThreshold)) {
+ if ((collateralValue - nftValue).percentMul(liquidationThreshold) < userDebt) {
revert WithdrawalWouldLeaveUserUnderCollateralized();
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::borrow as well as withdrawNFT() reverses collateralization check, comparing collateral < debt*0.8 instead of collateral*0.8 > debt, allowing 125% borrowing vs intended 80%

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.