Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Users can manipulate mapping values for other users ( potential DOS )

rockson

Summary

initiateLiquidation function in LendingPool.sol allows manipulation of isUnderLiquidation mapping for arbitrary users, enabling DoS or griefing attacks.

Vulnerability Details

The initiateLiquidation function in LendingPool.sol allows anyone to set the isUnderLiquidation flag for any userAddress. This function is intended to be called when a user's health factor falls below the liquidation threshold. However, the function lacks proper access control, allowing any external caller to trigger the isUnderLiquidation flag for any user, regardless of their actual health factor or liquidation status.

447: function initiateLiquidation(address userAddress) external nonReentrant whenNotPaused {
448: if (isUnderLiquidation[userAddress]) revert UserAlreadyUnderLiquidation();
449:
450: // update state
451: ReserveLibrary.updateReserveState(reserve, rateData);
452:
453: UserData storage user = userData[userAddress];
454:
455: uint256 healthFactor = calculateHealthFactor(userAddress);
456:
457: if (healthFactor >= healthFactorLiquidationThreshold) revert HealthFactorTooLow();
458:
459: isUnderLiquidation[userAddress] = true; // <--- VULNERABILITY: Anyone can set this flag for any user
460: liquidationStartTime[userAddress] = block.timestamp;
461:
462: emit LiquidationInitiated(msg.sender, userAddress);
463: }
​

Impact

Denial of Service (DoS) and Griefing. Attackers can arbitrarily set the isUnderLiquidation flag for any user, even those with healthy collateralization ratios. This leads to:

  • DoS: Users can be falsely marked as under liquidation, preventing them from performing legitimate actions like borrowing or withdrawing NFTs, effectively denying them service.

  • Griefing: Attackers can trigger unnecessary liquidation processes, causing gas costs and disruption for targeted users, even if they are not actually undercollateralized.

  • User trust(Protocol Reputation): Unfair and unwarranted liquidations can damage the protocol's user trust.

Tools Used

manually

Recommendations

  1. Immediate Mitigation: Implement proper access control for the initiateLiquidation function. Restrict access to authorized liquidators (e.g., Stability Pool, designated liquidator contracts, or governance-approved roles) who can verify the user's health factor before initiating liquidation. Remove public access.

Mitigation (Code Example)

In LendingPool.sol, add onlyStabilityPool modifier to initiateLiquidation function:

function initiateLiquidation(address userAddress) external nonReentrant whenNotPaused onlyStabilityPool { // <--- ADD onlyStabilityPool
// ... rest of function ...
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.