Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Borrowers can't be liquidated

dimah7

Summary

When a borrowers health factor becomes unhealthy, any user can initiate a liquidation on his position and finally the the owner of Stability pool finalizes it. However due to insufficient balances the liquidations will revert.

Vulnerability Details

​
StabilityPool:
​
function liquidateBorrower(address userAddress) external onlyManagerOrOwner nonReentrant whenNotPaused {
// Get the user's debt from the LendingPool.
uint256 userDebt = lendingPool.getUserDebt(userAddress);
uint256 scaledUserDebt = WadRayMath.rayMul(userDebt, lendingPool.getNormalizedDebt());
​
if (userDebt == 0) revert InvalidAmount();
​
uint256 crvUSDBalance = crvUSDToken.balanceOf(address(this));
if (crvUSDBalance < scaledUserDebt) revert InsufficientBalance();
​
// Approve the LendingPool to transfer the debt amount
bool approveSuccess = crvUSDToken.approve(address(lendingPool), scaledUserDebt);
if (!approveSuccess) revert ApprovalFailed();
​
// Call finalizeLiquidation on LendingPool
lendingPool.finalizeLiquidation(userAddress);
​
emit BorrowerLiquidated(userAddress, scaledUserDebt);
}

As can be seen first it checks if the balance of the crvUSD token is sufficient. The problem is that the stability pool is not holding any crvUSD tokens. The only tokens deposited to the pool are RTokens and NFT's. So the call will revert with InsufficientBalance error.

Impact

Not be able to liquidate borrowers means, they can run with the borrowed amounts - High

Tools Used

Manual Review

Recommendations

Supply some crvUSD tokens to the Stability pool before liquidations.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

StabilityPool design flaw where liquidations will always fail as StabilityPool receives rTokens but LendingPool expects it to provide crvUSD

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!