Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

User's NFTs can become trapped in protocol due to unbounded deposit array

rampage

Summary

A missing check on maximum NFT deposits will cause NFTs to become trapped in the protocol for users as the excessive array size will cause core functions to revert due to out-of-gas errors.

Root Cause

In LendingPool.sol there is no limit on the number of NFTs a user can deposit, which can lead to gas limits being exceeded in array iteration functions.

function depositNFT(uint256 tokenId) external nonReentrant whenNotPaused {
// update state
ReserveLibrary.updateReserveState(reserve, rateData);
​
if (raacNFT.ownerOf(tokenId) != msg.sender) revert NotOwnerOfNFT();
​
UserData storage user = userData[msg.sender];
if (user.depositedNFTs[tokenId]) revert NFTAlreadyDeposited();
​
​
user.nftTokenIds.push(tokenId);
user.depositedNFTs[tokenId] = true;
​
raacNFT.safeTransferFrom(msg.sender, address(this), tokenId);
​
​
emit NFTDeposited(msg.sender, tokenId);
}

Impact

When a user deposits too many NFTs, core functions like withdrawNFT(), borrow(), and initiateLiquidation() will revert due to the unbounded array iteration in getUserCollateralValue():

function getUserCollateralValue(address userAddress) public view returns (uint256) {
UserData storage user = userData[userAddress];
uint256 totalValue = 0;
​
for (uint256 i = 0; i < user.nftTokenIds.length; i++) {
uint256 tokenId = user.nftTokenIds[i];
uint256 price = getNFTPrice(tokenId);
totalValue += price;
}
​
return totalValue;
}

This results in user's NFTs becoming permanently locked in the protocol as they cannot execute withdrawal transactions.

Mitigation

Implement a maximum limit on the number of NFTs a single user can deposit. Add a check in the depositNFT() function to enforce this limit.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Design choice
Assigned finding tags:

LendingPool: Unbounded NFT array iteration in collateral valuation functions creates DoS risk, potentially blocking liquidations and critical operations

LightChaser L-36 and M-02 covers it.

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Design choice
Assigned finding tags:

LendingPool: Unbounded NFT array iteration in collateral valuation functions creates DoS risk, potentially blocking liquidations and critical operations

LightChaser L-36 and M-02 covers it.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!