Core Contracts

Summary

The withdrawNFT() and borrow() functions in the LendingPool contract contain an incorrect collateralization check, allowing users to withdraw or borrow more than their effective collateral value (collateralValue * liquidationThreshold). This flaw creates an opportunity for users to manipulate their collateral and debt levels, increasing the risk of bad debt for the protocol.

Vulnerability Details

The withdrawNFT() function allows users to withdraw NFTs they have deposited as collateral. To prevent users from becoming undercollateralized after withdrawal, the function includes the following check:

This check is incorrect because it applies the liquidation threshold to userDebt rather than the user's remaining collateral. As a result, users can withdraw NFTs while appearing to satisfy the condition, even though their remaining collateral is insufficient to cover their outstanding debt. A similar issue exists in the borrow() function, allowing users to borrow more than their collateral can safely support.

Impact

This vulnerability poses a critical risk to the protocol, as it directly affects the enforcement of collateralization requirements. If exploited, it allows borrowers to withdraw NFTs while leaving insufficient collateral to support their outstanding debt, potentially leading to situations where liquidations cannot recover the full amount owed. This increases the likelihood of lenders and liquidity providers bearing losses, ultimately threatening the protocol’s stability.

Tools Used

Manual Review

Recommendations

To correctly enforce collateral requirements, the flawed check should be replaced with the following: