Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Incorrect Collateral Value Emitted in `LiquidationFinalized` Event

johny7173

Summary

The finalizeLiquidation function in LendingPool.sol emits a LiquidationFinalized event at the end of execution. However, the collateralLiquidated value in this event is determined using the getUserCollateralValue function, which returns 0 at this stage of execution due to the user’s collateral having already been transferred and user.nftTokenIds being deleted. This results in an inaccurate event emission, which could mislead off-chain services or monitoring systems.

Vulnerability Details

In the finalizeLiquidation function:

  1. The contract transfers all NFTs owned by the user to the stabilityPool.

  2. The user.nftTokenIds array is deleted after transferring the NFTs.

  3. The event LiquidationFinalized is emitted, where the collateralLiquidated value is determined by calling getUserCollateralValue(userAddress).

  4. However, since user.nftTokenIds has been deleted, getUserCollateralValue returns 0, leading to incorrect data in the emitted event.

Relevant code snippet:

// Transfer NFTs to Stability Pool
for (uint256 i = 0; i < user.nftTokenIds.length; i++) {
uint256 tokenId = user.nftTokenIds[i];
user.depositedNFTs[tokenId] = false;
raacNFT.transferFrom(address(this), stabilityPool, tokenId);
}
delete user.nftTokenIds;
​
// Event emission with incorrect collateral value
emit LiquidationFinalized(stabilityPool, userAddress, userDebt, getUserCollateralValue(userAddress));

Since getUserCollateralValue relies on user.nftTokenIds, which is already deleted, the function always returns 0, resulting in an incorrect event emission.

Impact

  • Off-chain monitoring systems relying on LiquidationFinalized for accurate collateral liquidation data may be misled.

  • Potential issues with integrations that depend on correct event logs for liquidation tracking.

Tools Used

Manual code review

Recommended Mitigation

To ensure accurate event emission, the contract should store the user's collateral value before deleting user.nftTokenIds and pass this value to the event.

Suggested fix:
Modify the function as follows:

uint256 collateralValue = getUserCollateralValue(userAddress); // Store before deletion
​
// Transfer NFTs to Stability Pool
for (uint256 i = 0; i < user.nftTokenIds.length; i++) {
uint256 tokenId = user.nftTokenIds[i];
user.depositedNFTs[tokenId] = false;
raacNFT.transferFrom(address(this), stabilityPool, tokenId);
}
delete user.nftTokenIds;
​
// Emit event with the correct collateral value
emit LiquidationFinalized(stabilityPool, userAddress, userDebt, collateralValue);
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::finalizeLiquidation emits 0 collateralLiquidated because it deletes the info required to compute it

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!