Core Contracts

Summary

In StabilityPool::liquidateBorrower-> the function calls the LendingPool::finalizeLiquidation-> which transfers the user being liquidated, NFT's to the stability pool during liquidation finalization.

The issues is that StabilityPooldoes not have any logic that can effectively handle and manage the NFT's it receives from the LendingPool-> effectively leaving the tokens locked in the StabilityPool.

Vulnerability Details

In LendingPool::finalizeLiquidation-> the user being liquidated has all of their NFT's transferred to StabilityPool.

Even though, StabilityPoolhas no logic to handle properly, the receiving of ERC721 tokens, the NFT's are sent using transferFrominstead of safeTransferFrom-> which will allow the StabilityPoolto receive them anyways and bypass the safety checks.

The StabilityPoolreceives the NFT's but can do nothing with them. The proper handling of ERC721 tokens by a contract requires either:

• Manual logic via onERC721Received that enables the contract to handle and manage the NFT's.

  function onERC721Received(

  address operator,

  address from,

  uint256 tokenId,

  bytes calldata data

  ) external returns (bytes4) {

  // Handle the received token here

  return this.onERC721Received.selector;

  }

• Inherit ERC721Holdercontract. The LendingPooldoes this, and allows the LendingPoolto effectively handle and manage the NFT's.

  contract LendingPool is ILendingPool, Ownable, ReentrancyGuard, ERC721Holder, Pausable {

Impact

The StabilityPoolcan receive the tokens and store the tokens in its balance, but loses all access to manage the tokens for any subsequent actions, they are just locked in the contract.

StabilityPoolloses access to the following:

• cannot transfer NFT's

• cannot approve other addresses to transfer the NFT's

• cannot sell NFT in a marketplace

• cannot use the NFT as collateral

• cannot update NFT properties

• cannot sell NFT to new buyers

Tools Used

Manual Review

Recommendations

Inherit the ERC721Holdercontract, just as the LendingPooldoes. This will allow the StabilityPoolto effectively handle and manage the NFT's it receives, and not have effectively locked tokens.