Core Contracts

Summary

The finalizeLiquidation function incorrectly liquidates all NFTs owned by a user when any single loan becomes eligible for liquidation, rather than only liquidating the NFT(s) associated with the specific underwater loan.

Vulnerability Details

The code iterates through and transfers all NFTs owned by the user without checking which NFT is associated with the underwater loan.

```solidity

for (uint256 i = 0; i < user.nftTokenIds.length; i++) {

uint256 tokenId = user.nftTokenIds[i];

user.depositedNFTs[tokenId] = false;

raacNFT.transferFrom(address(this), stabilityPool, tokenId);

}

```

Impact

• Users lose all collateral even if only one loan is underwater

• Healthy loans are forcibly liquidated

• Excessive financial loss for borrowers

• Potential protocol reputation damage

• Risk of legal issues due to improper liquidation

Tools Used

Manual review

Recommendations

Use toeknId to get the NFT which is being liquidated and transfer only that NFT