Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

No function to rescue ERC721, when liquidate position

ChainDefenders

Summary

When the StabilityPool liquidates a borrower's position, all NFTs from the position are sent to the StabilityPool. However, the StabilityPool does not have a function to withdraw these NFTs, resulting in them being permanently stuck in the contract.

Vulnerability Details

During the liquidation process, the StabilityPool calls lendingPool.finalizeLiquidation(userAddress), which transfers the borrower's NFTs to the StabilityPool. However, the StabilityPool contract lacks a mechanism to withdraw these NFTs. As a result, any NFTs transferred to the StabilityPool during liquidation cannot be recovered.

Impact

NFTs transferred to the StabilityPool during liquidation become permanently stuck in the contract. This leads to a loss of assets for the protocol, as there is no way to retrieve these NFTs.

Tools Used

Manual review

Recommendations

To resolve this issue, add a function to the StabilityPool contract that allows authorized parties (e.g., the owner or manager) to withdraw NFTs. This function should transfer the NFTs to a specified recipient address.

For example, implement the following function:

function withdrawNFT(address nftAddress, uint256 tokenId, address recipient) external onlyOwner nonReentrant whenNotPaused {
if (recipient == address(0)) revert InvalidAddress();
if (nftAddress == address(0)) revert InvalidAddress();
​
IERC721(nftAddress).safeTransferFrom(address(this), recipient, tokenId);
emit NFTWithdrawn(nftAddress, tokenId, recipient);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

Liquidated RAACNFTs are sent to the StabilityPool by LendingPool::finalizeLiquidation where they get stuck

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.