Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

`StabilityPool.sol` and `NFTLiquidator.sol` lacks NFT handling capability leading to potential NFT lockup

anchabadze

Description:

LendingPool::finalizeLiquidation transfers NFTs to the StabilityPool during liquidation. It uses transferFrom() instead of safeTransferFrom so transaction will be successful and will not revert.

// Transfer NFTs to Stability Pool
for (uint256 i = 0; i < user.nftTokenIds.length; i++) {
uint256 tokenId = user.nftTokenIds[i];
user.depositedNFTs[tokenId] = false;
raacNFT.transferFrom(address(this), stabilityPool, tokenId); // <<<<<<
}

However, the StabilityPool contract is not properly equipped to handle NFT transfers as it. It does not implement onERC721Received function that should handle NFT in smart contracts.

The NFTLiquidator contract has the same issue. It receives NFTs from StabilityPool during liquidation process when StabilityPool is calling NFTLiquidator::liquidateNFT function

function liquidateNFT(uint256 tokenId, uint256 debt) external {
if (msg.sender != stabilityPool) revert OnlyStabilityPool();
// receiving NFT
nftContract.transferFrom(msg.sender, address(this), tokenId); // <<<<<<
tokenData[tokenId] =
TokenData({debt: debt, auctionEndTime: block.timestamp + 3 days, highestBid: 0, highestBidder: address(0)});
indexToken.mint(stabilityPool, debt);
emit NFTLiquidated(tokenId, debt);
emit AuctionStarted(tokenId, debt, tokenData[tokenId].auctionEndTime);
}

As soon as liquidateNFT function uses transferFrom instead of safeTransferFrom, the transaction will be successful and will not revert. But the NFTLiquidator contract lacks proper NFT handling capability, which leads to issues

Impact:

  • NFTs transferred to StabilityPool and NFTLiquidator contracts during liquidation process can become permanently locked

  • Breaks the liquidation and auction mechanism of the protocol

  • Loss of user collateral value

  • Protocol's inability to recover bad debt through NFT auctions

Recommended Mitigation:

Add onERC721Received function toStabilityPool and NFTLiquidator contracts.

Updates

Lead Judging Commences

inallhonesty Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Liquidated RAACNFTs are sent to the StabilityPool by LendingPool::finalizeLiquidation where they get stuck

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.