Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Unfair Collateral Seizure Despite Full Debt Repayment Due to Manual Liquidation Closure Requirement

DRUGstore

Summary

The protocol allows collateral to be seized even after a user fully repays their debt if they fail to manually call `closeLiquidation`. This design flaw forces users to take an unnecessary extra step to protect their assets, unfairly penalizing compliant borrowers.

Vulnerability Details

  • Manual Closure Requirement: Full repayment does not automatically terminate liquidation status, instead users must explicitly call closeLiquidation after repayment to avoid collateral seizure.

  • Also, closeLiquidation is callable only by the user, preventing third-party/bot assistance.

  • Upon Full Repayment of loan, we should have a Auto-Close Mechanism.

Faulty Workflow

1.User Repays Full Debt:

function repay(...) internal {
user.scaledDebtBalance -= amountBurned; // Debt reduced to zero
}

2.Liquidation Finalization Still Possible:

function finalizeLiquidation(...) external onlyStabilityPool {
// Transfers all collateral to StabilityPool
transferAllCollateral(stabilityPool);
}

Impact

High Severity (Direct Financial Loss + Protocol Trust Erosion):

  • Collateral Theft: Users lose assets despite fulfilling obligations

  • UX Hazard: Relies on user awareness of obscure manual step

  • Reputational Damage: Perceived as predatory protocol behavior

Recommendations:

  • Either: Access Control Expansion

    • Allow trusted keepers (e.g., Chainlink Automation) to call closeLiquidation

  • Or, Modify the repayment logic to auto-close liquidations when debt is fully repaid:

    function \_repay(...) internal {
    // Existing repayment logic
    if (user.scaledDebtBalance == 0) {
    \_closeLiquidation(onBehalfOf); // Auto-trigger closure
    }
    }
    ​
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

A borrower can LendingPool::repay to avoid liquidation but might not be able to call LendingPool::closeLiquidation successfully due to grace period check, loses both funds and collateral

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!