MEDIUM severity: The vulnerability lies in the implementation of the ERC721Pool contract, specifically in its handlin. The vulnerability lies in the implementation of the ERC721Pool contract, specifically in its handling of non-standard NFTs, such as CryptoKitty and CryptoFighter. The contract allows for the pausing of these NFTs, which can block borrowing, repaying, and liquidating actions in the pool. This is beca...

Vulnerable code:
```\nNFTTypes nftType;\n\nif (collateral_ == 0xb47e3cd837dDF8e4c57F05d70Ab865de6e193BBB) {\n    nftType = NFTTypes.CRYPTOPUNKS;\n}\n\nelse if (collateral_ == 0x06012c8cf97BEaD5deAe237070F9587f8E7A266d || collateral_ == 0x87d598064c736dd0C712D329aFCFAA0Ccc1921A1) {\n    nftType = NFTTypes.CRYPTOKITTIES;\n}\n\nelse {\n    try IERC165(collateral_).supportsInterface(0x80ac58cd) returns (bool supportsERC721Interface) {\n        if (!supportsERC721Interface) {\n            revert NFTNotSupported();\n        }\n    } catch {\n        revert NFTNotSupported();\n    }\n\n    nftType = NFTTypes.STANDARD_ERC721;\n}\n```\n```\n/**\n * Helper function for transferring multiple NFT tokens from msg.sender to pool.\n * Reverts in case token id is not supported by subset pool.\n * \n * @param poolTokens_ Array in pool that tracks NFT ids (could be tracking NFTs pledged by borrower or NFTs added by a lender in a specific bucket).\n * @param tokenIds_   Array of NFT token ids to transfer from msg.sender to pool.\n */\n\nfunction _transferFromSenderToPool(\n    uint256[] storage poolTokens_,\n    uint256[] calldata tokenIds_\n) internal {\n    bool subset = _getArgUint256(SUBSET)!= 0;\n    uint8 nftType = _getArgUint8(NFT_TYPE);\n\n    for (uint256 i = 0; i < tokenIds_.length; i++) {\n        uint256 tokenId = tokenIds_[i];\n        if (subset &&!tokenIdsAllowed[tokenId]) {\n            revert OnlySubset();\n        }\n        poolTokens_.push(tokenId);\n\n        if (nftType == uint8(NFTTypes.STANDARD_ERC721)) {\n            _transferNFT(msg.sender, address(this), tokenId);\n        } else if (nftType == uint8(NFTTypes.CRYPTOKITTIES)) {\n            ICryptoKitties(_getArgAddress(COLLATERAL_ADDRESS)).transferFrom(msg.sender, address(this), tokenId);\n        } else {\n            ICryptoPunks(_getArgAddress(COLLATERAL_ADDRESS)).buyPunk(tokenId);\n        }\n\n        unchecked {\n            ++i;\n        }\n    }\n}\n```\n```\nuint8 nftType = _getArgUint8(NFT_TYPE);\n\nfor (uint256 i = 0; i < amountToRemove_;) {\n    uint256 tokenId = poolTokens_[--noOfNFTsInPool]; // start with transferring the last token added in bucket\n    poolTokens_.pop();\n\n    if (nftType == uint8(NFTTypes.STANDARD_ERC721)) {\n        _transferNFT(address(this), toAddress_, tokenId);\n    } else if (nftType == uint8(NFTTypes.CRYPTOKITTIES)) {\n        ICryptoKitties(_getArgAddress(COLLATERAL_ADDRESS)).transfer(toAddress_, tokenId);\n    } else {\n        ICryptoPunks(_getArgAddress(COLLATERAL_ADDRESS)).transferPunk(toAddress_, tokenId);\n    }\n\n    tokensTransferred[i] = tokenId;\n\n    unchecked {\n        ++i;\n    }\n}\n```\n```\nif (nftType == uint8(NFTTypes.CRYPTOKITTIES)) {\n    ICryptoKitties(_getArgAddress(COLLATERAL_ADDRESS)).transferFrom(msg.sender, address(this), tokenId);\n}\n```\n```\nelse if (nftType == uint8(NFTTypes.CRYPTOKITTIES)) {\n    ICryptoKitties(_getArgAddress(COLLATERAL_ADDRESS)).transfer(toAddress_, tokenId);\n}\n```\n```\nfunction transferFrom(\n    address _from,\n    address _to,\n    uint256 _tokenId\n)\npublic\nwhenNotPaused {\n```\n```\nfunction transferFrom(\n    address _from,\n    address _to,\n    uint256 _tokenId\n) \nexternal \nwhenNotPaused {\n```