Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

When borrowers are liquidated, Stability Pool cannot receive the liquidated NFTs

0xgremlincat

Summary

StabilityPool.sol is expected to recieve RAAC NFTs as a result of liquidations. However, StabilityPool.sol does not import ERC721Holder. NFT transfers will fail and revert.

Vulnerability Details

In LendingPool.sol, finalizeLiquidation()function will allow the Stability Pool to finalize the liquidation. In this function, the collateral of borrowers are transferred to Stability Pool as seen here:

// Transfer NFTs to Stability Pool
for (uint256 i = 0; i < user.nftTokenIds.length; i++) {
uint256 tokenId = user.nftTokenIds[i];
user.depositedNFTs[tokenId] = false;
raacNFT.transferFrom(address(this), stabilityPool, tokenId);

However, StabilityPool.sol does not import ERC721Holderas seen here:

import "@openzeppelin/contracts-upgradeable/access/OwnableUpgradeable.sol";
import "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";
import "@openzeppelin/contracts-upgradeable/utils/PausableUpgradeable.sol";
​
import "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";
import "@openzeppelin/contracts/utils/ReentrancyGuard.sol";
import "@openzeppelin/contracts/token/ERC20/IERC20.sol";
​
import "../../../libraries/math/WadRayMath.sol";
​
import "../../../interfaces/core/pools/StabilityPool/IStabilityPool.sol";
import "../../../interfaces/core/pools/LendingPool/ILendingPool.sol";
import "../../../interfaces/core/minters/RAACMinter/IRAACMinter.sol";
import "../../../interfaces/core/tokens/IRAACToken.sol";
import "../../../interfaces/core/tokens/IRToken.sol";
import "../../../interfaces/core/tokens/IDEToken.sol";
​
contract StabilityPool is IStabilityPool, Initializable, ReentrancyGuard, OwnableUpgradeable, PausableUpgradeable {

ERC721Holderprovides the required onERC721Receivedfunction that is required to allow the contract to accept NFTs. In safeTransferFrom, there is also a onERC721Receivedcheck when transferring ERC-721 tokens to contracts.

Impact

RAAC NFT transfers to Stability Pool will always fail.

Tools Used

Manual

Recommendations

Import ERC721Holderand ensure contract StabilityPool is ERC721Holder.

import "@openzeppelin/contracts/token/ERC721/utils/ERC721Holder.sol";
...
contract StabilityPool is ERC721Holder, IStabilityPool, Initializable, ReentrancyGuard, OwnableUpgradeable, PausableUpgradeable {
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!