Core Contracts

Summary

The NFTLiquidator contract implements a critical liquidation mechanism that is completely broken due to two major design flaws:

1. The liquidateNFT() function can only be called by StabilityPool, but StabilityPool has no mechanism to call it

2. The function assumes StabilityPool has approved NFTLiquidator to transfer NFTs, but there's no approval mechanism in place

This creates a situation where NFTs can never enter the liquidation auction system, effectively breaking a core protocol mechanism.

Vulnerability Details

Let's break down how the liquidation flow fails:

1. First, let's look at NFTLiquidator's requirements:

1. However, examining StabilityPool, we find:

   • No function to call liquidateNFT()

   • No approval mechanism for NFTLiquidator

   • No way to initiate the liquidation auction process

2. This creates a deadlock where:

   • NFTs can only be liquidated by StabilityPool (msg.sender check)

   • StabilityPool needs to approve NFTLiquidator (for transferFrom)

   • StabilityPool has no functions to do either

   • Result: NFTs can never enter the auction system

3. The transfer would fail in two ways:

Impact

The impact for this:

1. Core liquidation mechanism is completely broken

2. No way to liquidate NFTs through the intended auction system

3. Affects all liquidations, not just edge cases

4. No workaround available within current contract design

5. Could lead to protocol insolvency as bad debt cannot be liquidated

Root Cause

The root cause is a critical design flaw in the liquidation architecture:

1. NFTLiquidator expects StabilityPool to:

   • Call liquidateNFT()

   • Have approved NFT transfers

2. But StabilityPool has neither:

   • No function to call NFTLiquidator

   • No approval mechanism

3. This creates an impossible condition where liquidations can never occur

Tools Used

Manual review

Recommendations

The protocol needs to implement a complete liquidation flow. Two potential approaches:

1. Add required functionality to StabilityPool:

1. Redesign the liquidation flow:

• Remove the StabilityPool requirement from NFTLiquidator

• Allow LendingPool to directly initiate liquidations

• Implement proper access controls and approval mechanisms