Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Missing `crvUSD` funding mechanism in `finalizeLiquidation()`

cipher27

Summary

The finalizeLiquidation() function attempts to transfer crvUSD from StabilityPool without a proper funding mechanism in place.

Vulnerability Details

The finalizeLiquidation() function attempts to transfer crvUSD from StabilityPool.

File: LendingPool.sol
524: // Transfer reserve assets from Stability Pool to cover the debt
525: IERC20(reserve.reserveAssetAddress).safeTransferFrom(msg.sender, reserve.reserveRTokenAddress, amountScaled);

But StabilityPool doesn't have crvUSD at all because crvUSD will be stored in LendingPool contract.

As a result, the above transfer will fail and the liquidation logic will be broken.

Impact

The liquidation process fails due to insufficient crvUSD balance in the StabilityPool contract.

Recommendations

Implement a mechanism to ensure the StabilityPool has sufficient crvUSD before attempting liquidations.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

StabilityPool design flaw where liquidations will always fail as StabilityPool receives rTokens but LendingPool expects it to provide crvUSD

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!