Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Locked NFT Collateral in Stability Pool

mahdikarimi

Summary

The Stability Pool is responsible for liquidating users in the Lending Pool by paying off their debt using Stability Pool funds. In return, the Stability Pool receives collateral in the form of NFT tokens. However, there is no implemented mechanism in the Stability Pool contract to access or redistribute these NFTs. As a result, these collaterals become permanently locked, rendering them unusable and leading to inefficiencies in protocol operations.

Vulnerability Details

When a borrower is liquidated, their NFT collateral is transferred to the Stability Pool. However, there is no function within the Stability Pool to manage these NFTs, meaning they remain locked in the contract indefinitely. This results in an inability to redistribute the collateral, sell it, or use it to compensate depositors.

Code Reference:

// @audit Stability pool lacks a mechanism to manage seized NFTs
function liquidateBorrower(address userAddress) external onlyManagerOrOwner nonReentrant whenNotPaused {
_update();
uint256 userDebt = lendingPool.getUserDebt(userAddress);
if (userDebt == 0) revert InvalidAmount();
uint256 crvUSDBalance = crvUSDToken.balanceOf(address(this));
if (crvUSDBalance < userDebt) revert InsufficientBalance();
crvUSDToken.approve(address(lendingPool), userDebt);
lendingPool.finalizeLiquidation(userAddress);
emit BorrowerLiquidated(userAddress, userDebt);
}

Exploitation Scenario:

  1. A user is liquidated in the Lending Pool.

  2. The Stability Pool covers the user’s debt by paying the required funds.

  3. The user’s NFT collateral is transferred to the Stability Pool contract.

  4. There is no function to claim, auction, or manage these NFTs.

  5. The collateral remains permanently locked within the Stability Pool, leading to an accumulation of inaccessible assets.

Impact

  • Locked Assets: NFT collateral becomes permanently inaccessible within the Stability Pool.

  • Loss of Value: The Stability Pool cannot sell or redistribute NFTs, reducing the value available to depositors.

Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Liquidated RAACNFTs are sent to the StabilityPool by LendingPool::finalizeLiquidation where they get stuck

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.