corrupt liquidationthreshold calculation in withdraw nft
Vulnerability Details
The withdrawNFT function uses the same flawed logic as the borrow function, applying the liquidation threshold to debt instead of collateral. This allows users to withdraw NFTs even if the remaining collateral becomes insufficient to cover their debt, leading to undercollateralized positions.
Proof of Concept
uint256 collateralValue = 200$
uint256 nftValue = 100$
uint256 userDebt = 125$
uint256 liquidationThreshold = 8000; // 80% in basis points
What the code does
userDebt.percentMul(liquidationThreshold) = 125e18 * 8000 / 10000 = 100e18 ($100)
if (100e18 < 100e18) → false → withdrawal allowed
Impact
The inverted check allows collateral to drop below debt / threshold leavinf the debt undercollaterlized leading to loss of funds for the protocol
Tools Used
Recommendations
use the correct logic for liquidationthreshold calculation
Lead Judging Commences
LendingPool::borrow as well as withdrawNFT() reverses collateralization check, comparing collateral < debt*0.8 instead of collateral*0.8 > debt, allowing 125% borrowing vs intended 80%
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.