Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Collateral NFT will be forever stuck in the StabilityPool.sol after liquidating the positions

anonymousjoe

Summary

During liquidations, when the stabilityPool.sol calls the finalizeLiquidation function in the lending pool, the users collateral NFT are transferred to the stabilityPool, but then these NFT are stuck in the stabilityPool. There is no way to do further actions on them

Vulnerability Details

When a liquidation happense, the user's collateral is transferred to the stabilityPool which doesnt have the ability to transact them further.

function finalizeLiquidation(address userAddress) external nonReentrant onlyStabilityPool {
if (!isUnderLiquidation[userAddress]) revert NotUnderLiquidation();
​
// update state
ReserveLibrary.updateReserveState(reserve, rateData);
​
if (block.timestamp <= liquidationStartTime[userAddress] + liquidationGracePeriod) {
revert GracePeriodNotExpired();
}
​
UserData storage user = userData[userAddress];
​
uint256 userDebt = user.scaledDebtBalance.rayMul(reserve.usageIndex);
​
isUnderLiquidation[userAddress] = false;
liquidationStartTime[userAddress] = 0;
// Transfer NFTs to Stability Pool
for (uint256 i = 0; i < user.nftTokenIds.length; i++) {
uint256 tokenId = user.nftTokenIds[i];
user.depositedNFTs[tokenId] = false;
// transferring the collateral NFT to the stability Pool
raacNFT.transferFrom(address(this), stabilityPool, tokenId);
}

Impact

collateral NFT forever locked in the stabilityPool, it will be then useless to the protocol.

Tools Used

manual review

Recommendations

Add functions in the stabilityPool for further transactions of these NFT's.

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Liquidated RAACNFTs are sent to the StabilityPool by LendingPool::finalizeLiquidation where they get stuck

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.