Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect `liquidationThreshold` Check in the `LendingPool.withdrawNFT()` Function

kupiasec

Summary

When withdrawing an NFT, it is essential to safeguard the user's financial health by comparing collateralValue with userDebt using the liquidationThreshold factor. However, the current implementation incorrectly multiplies liquidationThreshold with userDebt instead of collateralValue, leading to an erroneous threshold check.

Vulnerability Details

The withdrawNFT() function currently compares collateralValue against userDebt multiplied by liquidationThreshold. This approach is flawed.

To ensure accuracy, userDebt should not exceed collateralValue multiplied by liquidationThreshold. In other words, liquidationThreshold should be applied to collateralValue instead of userDebt.

Due to this implementation, with a liquidationThreshold set at 80%, userDebt can reach up to 125% of the user's collateral, resulting in potential financial losses for the protocol.

function withdrawNFT(uint256 tokenId) external nonReentrant whenNotPaused {
...
​
uint256 userDebt = user.scaledDebtBalance.rayMul(reserve.usageIndex);
uint256 collateralValue = getUserCollateralValue(msg.sender);
uint256 nftValue = getNFTPrice(tokenId);
​
302 if (collateralValue - nftValue < userDebt.percentMul(liquidationThreshold)) {
revert WithdrawalWouldLeaveUserUnderCollateralized();
}
​
...
}

Impact

Malicious users could borrow more than their collateral allows, leading to financial losses for the protocol.

Tools Used

Manual review

Recommendations

The liquidationThreshold should be applied to collateralValue instead of userDebt.

function withdrawNFT(uint256 tokenId) external nonReentrant whenNotPaused {
...
​
uint256 userDebt = user.scaledDebtBalance.rayMul(reserve.usageIndex);
uint256 collateralValue = getUserCollateralValue(msg.sender);
uint256 nftValue = getNFTPrice(tokenId);
​
- if (collateralValue - nftValue < userDebt.percentMul(liquidationThreshold)) {
+ if ((collateralValue - nftValue).percentMul(liquidationThreshold) < userDebt) {
revert WithdrawalWouldLeaveUserUnderCollateralized();
}
​
...
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::borrow as well as withdrawNFT() reverses collateralization check, comparing collateral < debt*0.8 instead of collateral*0.8 > debt, allowing 125% borrowing vs intended 80%

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!