# BendDAO V2 audit Code4rena · NFT lending · 19th June 2024 A private security review of BendDAO (NFT lending), conducted with Code4rena and completed on 19th June 2024. 0xSimao disclosed 8 findings: 4 high severity and 4 medium. ## What BendDAO is BendDAO is NFT-backed lending: blue-chip NFTs are deposited as collateral, ETH and stablecoins are borrowed against them, and liquidations auction the collateral when health factors fail. ## Scope The BendDAO V2 smart contract system, reviewed in a Code4rena Zenith invitational with a four-person team: the rebuilt pool, yield and cross-margin machinery. ## High severity findings - [Mismatch between yield amount deposited in shares calculation and getAccountYieldBalance()](https://0xsimao.com/findings/benddao-mismatch-yield-deposited-shares) - [Bad debt is never handled which places insolvency risks on BendDAO](https://0xsimao.com/findings/benddao-debt-places-insolvency-risks) - [Users cannot unstake from YiedlETHStakingEtherfi.sol, because YieldAccount.sol is incompatible with ether.fi's WithdrawRequestNFT.sol](https://0xsimao.com/findings/benddao-unstake-eth-staking-yield) - [Anyone can get the NFT collateral token after an Auction without bidding due to missing check on msg.sender](https://0xsimao.com/findings/benddao-nft-collateral-auction-bidding) ## Medium severity findings - [Unhandled request invalidation by the owner of Etherfi will lead to stuck debt](https://0xsimao.com/findings/benddao-unhandled-invalidation-stuck-debt) - [Major insolvency risk in LiquidationLogic::executeCrossLiquidateERC721() due to not setting a maximum liquidation price](https://0xsimao.com/findings/benddao-insolvency-liquidation-liquidate-erc721) - [It's impossible to retrieve collected fines from the yield staking contract](https://0xsimao.com/findings/benddao-collected-fines-yield-staking) - [Borrower can prevent yield position repayment and closure by the bot](https://0xsimao.com/findings/benddao-yield-repayment-closure-bot) ## The report [Read the report](https://github.com/0xsimao/audits/blob/main/Code4rena/private-audits/2024-06-19-benddao.md)