Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

loan repayments are accepted post grace period

DRUGstore

Summary

The protocol permits debt repayments after the liquidation grace period expires but before `finalizeLiquidation` is executed. This creates a race condition where users lose both their repayment and collateral if liquidated, violating fundamental fairness in debt resolution.

Vulnerability Details

Key issues:

  • No Repayment Deadline: Repayments are accepted indefinitely until finalizeLiquidation is triggered.

  • Collateral/Repayment Double Loss: Users lose both despite post-grace repayments

  • Centralization Risk: StabilityPool managers control liquidation timing

Faulty Workflow

  1. Grace Period Expires:

require(block.timestamp > liquidationStartTime + gracePeriod, "Grace period ongoing");

  1. User Repayment is accepted/allowed post Grace period:

function repay(...) internal {
// No check for grace period expiration
user.scaledDebtBalance -= amountBurned;
}

  1. StabilityPool Finalizes Liquidation, but pays zero amount as debt is fully paid by user.

function liquidateBorrower(...) external onlyManagerOrOwner {
lendingPool.finalizeLiquidation(userAddress); // Seizes collateral
}

Impact

Critical Severity (Protocol Logic Failure + Direct Asset Loss):

  • Permanent Fund Loss: Users forfeit repayments made after grace period

  • Manipulatable Liquidations: StabilityPool can delay finalization to maximize penalty

  • Contractual Breach: Violates implied loan resolution terms

Recommendations

1. Block Post-Grace Repayments

function _repay(...) internal {
if (block.timestamp > liquidationStartTime[onBehalfOf] + gracePeriod) {
revert gracePeriodEnded();
}
// ... existing logic ...
}

2. Auto-Finalize on Grace Expiry

provide a public function that can be called by anyone/bots.

function checkLiquidationStatus(address user) public {
if (block.timestamp > liquidationStartTime[user] + gracePeriod) {
finalizeLiquidation(user);
}
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

A borrower can LendingPool::repay to avoid liquidation but might not be able to call LendingPool::closeLiquidation successfully due to grace period check, loses both funds and collateral

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!