Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Missing min/max grace period on finalizeLiquidation(), LeandingPool.sol

hawks

Summary

The finalizeLiquidation function contains multiple vulnerabilities that can result in incorrect calculations, inconsistent state updates. These issues could impact the stability and security of the liquidation process, potentially unfair liquidations.

Vulnerability Details

The function allows liquidations after a grace period, but there is no enforcement of a min/max bound for the liquidationGracePeriod. This lack of restriction could lead to unexpected delays or overly aggressive liquidations. Also the function updates the state after external call.

function finalizeLiquidation(address userAddress) external nonReentrant onlyStabilityPool {
if (!isUnderLiquidation[userAddress]) revert NotUnderLiquidation();
​
// update state
ReserveLibrary.updateReserveState(reserve, rateData);
​
if (block.timestamp <= liquidationStartTime[userAddress] + liquidationGracePeriod) {
revert GracePeriodNotExpired();
}
​
UserData storage user = userData[userAddress];
uint256 userDebt = user.scaledDebtBalance.rayMul(reserve.usageIndex);
​
isUnderLiquidation[userAddress] = false;
liquidationStartTime[userAddress] = 0;
// Transfer NFTs to Stability Pool
for (uint256 i = 0; i < user.nftTokenIds.length; i++) {
uint256 tokenId = user.nftTokenIds[i];
user.depositedNFTs[tokenId] = false;
raacNFT.transferFrom(address(this), stabilityPool, tokenId);
}
delete user.nftTokenIds;
(uint256 amountScaled, uint256 newTotalSupply, uint256 amountBurned, uint256 balanceIncrease) = IDebtToken(reserve.reserveDebtTokenAddress).burn(userAddress, userDebt, reserve.usageIndex);t
IERC20(reserve.reserveAssetAddress).safeTransferFrom(msg.sender, reserve.reserveRTokenAddress, amountScaled);
​
// @ audit updates the state after external call
user.scaledDebtBalance -= amountBurned;
reserve.totalUsage = newTotalSupply;
​
// @ audit updates the state after external call
ReserveLibrary.updateInterestRatesAndLiquidity(reserve, rateData, amountScaled, 0);
emit LiquidationFinalized(stabilityPool, userAddress, userDebt, getUserCollateralValue(userAddress));
}

Impact

Missing grace period protection means liquidations might happen too soon or too late, impacting users unfairly.

If safeTransferFrom or transferFrom fails, the contract will be left in an inconsistent state, potentially leading to debt mismatches and asset mismanagement.

Potential Loss of NFTs

Tools Used

Manual review

Recommendations

Implement min and max grace period protection, and update the state before external calls.

Updates

Lead Judging Commences

inallhonesty Lead Judge
5 months ago
inallhonesty Lead Judge about 2 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.