Submission Details
Severity:
StabilityPool receives RAAC NFTs on liquidation but has no function to handle the NFTs causing them to be locked in StabilityPool
Summary
StabilityPool is used to liquidate borrowers which sends borrowers NFTs to the StabilityPool. But the stabilityPool lacks implementation to handle the NFTs causing them to be locked for ever in the contract
Vulnerability Details
function liquidateBorrower(address userAddress) external onlyManagerOrOwner nonReentrant whenNotPaused {
_update();
// Get the user's debt from the LendingPool.
uint256 userDebt = lendingPool.getUserDebt(userAddress);
uint256 scaledUserDebt = WadRayMath.rayMul(userDebt, lendingPool.getNormalizedDebt());
if (userDebt == 0) revert InvalidAmount();
uint256 crvUSDBalance = crvUSDToken.balanceOf(address(this));
if (crvUSDBalance < scaledUserDebt) revert InsufficientBalance();
// Approve the LendingPool to transfer the debt amount
bool approveSuccess = crvUSDToken.approve(address(lendingPool), scaledUserDebt);
if (!approveSuccess) revert ApprovalFailed();
// Update lending pool state before liquidation
lendingPool.updateState();
// Call finalizeLiquidation on LendingPool
// @audit Receives NFT but doesn't implement nftReceiver and any NFT transfer feature
lendingPool.finalizeLiquidation(userAddress);
emit BorrowerLiquidated(userAddress, scaledUserDebt);
}
lendingPool.finalizeLiquidation sends the NFT to StabilityPool.
StabilityPool has no other function handling the NFTs
Impact
Impact is high as RAAC NFTs will be locked in the StabilityPool for liquidated users
Recommendations
Add functions for handling NFTs from liquidated users
Updates
Lead Judging Commences
inallhonesty 3 months ago
Submission Judgement Published Assigned finding tags:
Liquidated RAACNFTs are sent to the StabilityPool by LendingPool::finalizeLiquidation where they get stuck
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.