Users Can Deposit NFTs While Under Liquidation Leading to Immediate Loss of New Collateral
Summary
In the LendingPool contract, users who are under liquidation can still deposit new NFTs via depositNFT(). Since there is no check preventing deposits while under liquidation, these newly deposited NFTs will be immediately liquidated along with the user's existing collateral once the grace period expires.
This creates a dangerous situation where users who don't understand the liquidation process could lose additional NFTs by trying to add more collateral to improve their position after liquidation has already started and grace period expired.
Impact
Users under liquidation can lose additional NFTs by depositing them during the grace period. When finalizeLiquidation() is called after the grace period, ALL NFTs in the user's collateral (including newly deposited ones) are transferred to the Stability Pool.
Recommendations
Add a check in depositNFT() to prevent deposits while under liquidation and grace period expired.
Lead Judging Commences
Users can deposit NFTs using LendingPool::depositNFT while under liquidation, leading to unfair liquidation of NFTs that weren't part of original position
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.