Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Missing Stability Pool Balance Check in Liquidation

ibukunola

Summary

The finalizeLiquidation() function transfers crvUSD from the Stability Pool without checking its balance, risking reversion after NFT transfers. This medium-impact, medium-likelihood issue could leave debt uncleared and collateral lost, causing protocol losses.

Vulnerability Details

The function uses SafeERC20.safeTransferFrom() without verifying funds. Example:

User has 1000 crvUSD debt, 2 NFTs (1200 crvUSD).
Stability Pool has 500 crvUSD.
NFTs transfer, but 1000 crvUSD transfer fails, leaving 1000 crvUSD debt and a 700 crvUSD net loss.
This disrupts liquidation integrity.

Impact

The protocol could lose value (e.g., 700 crvUSD per incident), a medium-impact financial hit. The medium likelihood reflects potential Stability Pool depletion during high liquidation volume, threatening solvency.

Tools Used

Testing Frameworks: Hardhat to simulate low-balance liquidations.

Recommendations

Add a balance check:

function finalizeLiquidation(address userAddress) external nonReentrant onlyStabilityPool {
// ... existing logic ...
require(reserveAssetToken.balanceOf(stabilityPool) >= amountScaled, "Insufficient Stability Pool funds");
// Transfer NFTs and proceed ...
}```
Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.