Core Contracts

Description:

The NFTLiquidator::buyBackNFT function is intended to allow the original NFT owner (who was liquidated) to buy back their NFT at 110% of the debt. However, the function lacks validation of the original owner.

This means:

• Any user can call buyBackNFT

• The buyback price (110% of debt) could be lower than potential auction prices

• There's no incentive to participate in auctions via placeBid when NFTs can be instantly bought at a lower price

Impact:

• Completely breaks the auction mechanism

• Reduces protocol's ability to maximize debt recovery

• Creates unfair advantage for quick buyers over auction participants

• Affects all liquidated NFTs

• Undermines the entire liquidation process

Recommended Mitigation:

Add original owner tracking with mapping and add check of the original owner to NFTLiquidator::buyBackNFT function.