Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Non-Functional Liquidation System Due to Token Flow Mismatch Between LendingPool and StabilityPool

0xgee001

Summary:

The protocol's liquidation mechanism is completely broken due to a fundamental design flaw in token flow. The StabilityPool requires crvUSD tokens for liquidations but has no mechanism to receive them, as all deposits are directed to the rToken contract instead.

Vulnerability Details:

In LendingPool deposit() function

function deposit(uint256 amount) external nonReentrant {
// Tokens are sent to rToken contract
uint256 mintedAmount = ReserveLibrary.deposit(reserve, rateData, amount, msg.sender);
// ... rest of function
}
// In ReserveLibrary:
IERC20(reserve.reserveAssetAddress).safeTransferFrom(
msg.sender,
reserve.reserveRTokenAddress, // ❌ Tokens go here instead of StabilityPool
amount
);

In StabilityPool liquidateBorrower

function liquidateBorrower(address userAddress) external onlyManagerOrOwner {
uint256 userDebt = lendingPool.getUserDebt(userAddress);
uint256 scaledUserDebt = WadRayMath.rayMul(userDebt, lendingPool.getNormalizedDebt());
// ❌ This check will always fail as balance is always 0
uint256 crvUSDBalance = crvUSDToken.balanceOf(address(this));
if (crvUSDBalance < scaledUserDebt) revert InsufficientBalance();
// ... liquidation logic that can never be reached
}

Impact:

  1. Critical System Failure:

    • Liquidations cannot be executed

    • Protocol's risk management is non-functional

    • No way to handle defaulted positions

  2. Economic Implications:

    • Bad debt cannot be cleared

    • Protocol becomes insolvent during market stress

    • User funds at risk

  3. System Design:

    • Core mechanism broken

    • No fallback liquidation path

    • Protocol effectively unusable

Tools Used:

Manual code review

Recommendations:

Adjust the token flow to make sure that the StabilityPool has access to crvUSD, or completely revise the liquidation logic.

Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

StabilityPool design flaw where liquidations will always fail as StabilityPool receives rTokens but LendingPool expects it to provide crvUSD

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.