Core Contracts

Summary

The liquidateNFT function in NFTLiquidator.sol is restricted to being called only by the StabilityPool. However, the StabilityPool.sol contract does not invoke this function, making NFTLiquidator effectively unusable. Since liquidateNFT is the entry point for NFT liquidations, auctions cannot be initiated, rendering the entire liquidation mechanism inoperable.

Vulnerability Details

The liquidateNFT function is designed to be called by the StabilityPool to initiate NFT liquidations. However, since no function within StabilityPool.sol actually calls liquidateNFT, the function remains unreachable. As a result:

• No NFTs can be liquidated.

• No auctions can be started.

• The system fails to function as intended, preventing the liquidation process and any recovery of bad debt through auction sales.

This issue stems from missing integration between StabilityPool and NFTLiquidator.

Relevant Code

Since the function is gated by msg.sender == stabilityPool, but StabilityPool.sol does not invoke it, the function remains dormant.

Impact

This vulnerability completely disables the liquidation process, preventing auctions from being conducted. The inability to liquidate under-collateralized NFTs can have the following consequences:

• No recovery mechanism for bad debt: The protocol cannot auction collateralized NFTs to recover debt, leading to potential insolvency.

• Broken liquidation flow: Any logic depending on NFT liquidations will fail, affecting protocol stability.

Tools Used

Manual code review

Recommended Mitigation

To fix this issue, ensure that StabilityPool.sol correctly calls liquidateNFT when necessary. Some possible solutions include:

• Explicitly invoking liquidateNFT in StabilityPool.sol when an NFT needs to be liquidated.

• Removing the sender restriction (msg.sender == stabilityPool) if other components should be allowed to trigger liquidations.

• Creating a dedicated liquidation function within StabilityPool that forwards the call to NFTLiquidator.

The correct fix depends on the intended protocol design, but without this integration, the liquidation mechanism remains non-functional.