BendDAO V2 audit
A private security review of BendDAO (NFT lending), conducted with Code4rena and completed on 19th June 2024. 0xSimao disclosed 8 findings: 4 high severity and 4 medium.
What BendDAO is
BendDAO is NFT-backed lending: blue-chip NFTs are deposited as collateral, ETH and stablecoins are borrowed against them, and liquidations auction the collateral when health factors fail.
Scope
The BendDAO V2 smart contract system, reviewed in a Code4rena Zenith invitational with a four-person team: the rebuilt pool, yield and cross-margin machinery.
High severity findings
- Mismatch between yield amount deposited in shares calculation and getAccountYieldBalance()
- Bad debt is never handled which places insolvency risks on BendDAO
- Users cannot unstake from YiedlETHStakingEtherfi.sol, because YieldAccount.sol is incompatible with ether.fi's WithdrawRequestNFT.sol
- Anyone can get the NFT collateral token after an Auction without bidding due to missing check on msg.sender
Medium severity findings
- Unhandled request invalidation by the owner of Etherfi will lead to stuck debt
- Major insolvency risk in LiquidationLogic::executeCrossLiquidateERC721() due to not setting a maximum liquidation price
- It's impossible to retrieve collected fines from the yield staking contract
- Borrower can prevent yield position repayment and closure by the bot
The report