Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

StabilityPool Liquidation Mechanism Broken Due to Incorrect crvUSD Token Flow

0xekkoo

Summary

The StabilityPool's liquidation mechanism is completely broken because it expects to have crvUSD tokens available for liquidations, but there is no way for the contract to receive these tokens. All crvUSD deposits are sent to the rToken contract instead of the StabilityPool.

Vulnerability Details

When users deposit crvUSD into the LendingPool, the tokens are transferred to the rToken contract:

uint256 mintedAmount = ReserveLibrary.deposit(reserve, rateData, amount, msg.sender);

IERC20(reserve.reserveAssetAddress).safeTransferFrom(
msg.sender,
reserve.reserveRTokenAddress,
amount
);

However, the StabilityPool's liquidateBorrower function expects to have sufficient crvUSD available:

function liquidateBorrower(address userAddress) external onlyManagerOrOwner nonReentrant whenNotPaused {
// Get the user's debt from the LendingPool.
uint256 userDebt = lendingPool.getUserDebt(userAddress);
uint256 scaledUserDebt = WadRayMath.rayMul(userDebt, lendingPool.getNormalizedDebt());
​
if (userDebt == 0) revert InvalidAmount();
​
uint256 crvUSDBalance = crvUSDToken.balanceOf(address(this));

This mismatch means:

  • StabilityPool never receives crvUSD tokens

  • crvUSDBalance check will always revert

  • Liquidations cannot be executed

  • The entire liquidation mechanism is non-functional

Impact

Impact
The protocol's liquidation mechanism is completely broken. No liquidations can be performed & bad debt cant be cleared.

Tools Used

Manual Review

Recommendation

Modify token flow to ensure StabilityPool has access to crvUSD or fix the entire liquidation logic.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

StabilityPool design flaw where liquidations will always fail as StabilityPool receives rTokens but LendingPool expects it to provide crvUSD

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!