Liquidated NFTs will be stuck on `StabilityPool`
Vulnerability Details
When a liquidation finishes the NFTs as collateral are transfered to the StabilityPool. See here. After this is executed, then liquidateBorrower() is executed in StabilityPool but no transfers are done so the NFT remains in the pool, see here.
The problem is that the StabilityPool can't transfer those NFTs anywhere else. If you parse all the transfers and approvals the pool has none is related to the RAACNFT contract. Furthermore none of the inherited contracts have such functions either:
Impact
Liquidated NFTs will be stuck in the StabilityPool. Fortunately, the StabilityPool is a contract that can be upgraded.
Recommendations
Add transfer liquidated NFTs functionality to the pool. Or set an approval on construction time to another address capable of managing the NFTs.
Lead Judging Commences
Liquidated RAACNFTs are sent to the StabilityPool by LendingPool::finalizeLiquidation where they get stuck
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.