Skip to content

Latest commit

 

History

History
43 lines (24 loc) · 1.77 KB

038.md

File metadata and controls

43 lines (24 loc) · 1.77 KB

Great Lava Cricket

High

NFT Withdrawal Blocked in cancelOffer Due to Incorrect 'availableAmount' Check

Summary

The 'cancelOffer' function prevents the owner from retrieving NFT collateral when canceling an offer. This occurs because the availableAmount is reset to zero before the NFT transfer condition is checked, causing the NFT retrieval condition to fail and locking the NFT in the contract.

Root Cause

The logic in 'cancelOffer' function sets availableAmount to zero immediately after checking it, which prevents the NFT transfer statement from executing due to the failed condition (m_borrowInformation.availableAmount > 0). Consequently, the owner cannot withdraw their NFT collateral after canceling.

https://github.com/sherlock-audit/2024-11-debita-finance-v3/blob/main/Debita-V3-Contracts/contracts/DebitaBorrowOffer-Implementation.sol#L199

Internal pre-conditions

The availableAmount is greater than zero initially. cancelOffer is called by the contract owner.

External pre-conditions

The owner has previously deposited an NFT as collateral. The owner has called cancelOffer to cancel their lending offer.

Attack Path

1 The owner calls cancelOffer expecting to retrieve their NFT. 2 The function immediately sets availableAmount to zero, failing the condition for the NFT transfer in the following block. 3 As a result, the owner's NFT is permanently locked in the contract.

Impact

This issue blocks owner from reclaiming their NFT collateral when they cancel an offer, effectively freezing their asset within the contract without any means of retrieval.

PoC

No response

Mitigation

remove the 'm_borrowInformation.availableAmount > 0' condition from the NFT transfer section or move the availableAmount update after the NFT collateral transfer