Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect Token Handling in liquidateBorrower Function Leading to Failed Liquidations

aksoy

Summary

The liquidateBorrower function in the StabilityPool contract attempts to approve and transfer crvUSD tokens to the LendingPool for liquidation. However, the StabilityPool does not hold crvUSD tokens; instead, it holds rTokens (which keeps crvUSD assets). This mismatch in token handling causes liquidations to fail, as the StabilityPool cannot transfer tokens it does not possess.

Vulnerability Details

The liquidateBorrower function attempts to approve and transfer crvUSD tokens. However, the StabilityPool holds rTokens (not crvUSD). The approval and transfer of crvUSD tokens will fail because the StabilityPool does not hold these tokens.

function liquidateBorrower(address userAddress) external onlyManagerOrOwner nonReentrant whenNotPaused {
_update();
// Get the user's debt from the LendingPool.
uint256 userDebt = lendingPool.getUserDebt(userAddress);
uint256 scaledUserDebt = WadRayMath.rayMul(userDebt, lendingPool.getNormalizedDebt());
​
if (userDebt == 0) revert InvalidAmount();
​
uint256 crvUSDBalance = crvUSDToken.balanceOf(address(this));
if (crvUSDBalance < scaledUserDebt) revert InsufficientBalance();
​
// Approve the LendingPool to transfer the debt amount
bool approveSuccess = crvUSDToken.approve(address(lendingPool), scaledUserDebt);
if (!approveSuccess) revert ApprovalFailed();

Impact

Liquidations cannot be executed due to the incorrect token handling.

Tools Used

Manual

Recommendations

Implement a new method to transfer crvUSD tokens. It could be transfered from rToken contract to LendingPool

Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

StabilityPool design flaw where liquidations will always fail as StabilityPool receives rTokens but LendingPool expects it to provide crvUSD

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.