Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Missing Price Staleness Check in `LendingPool::getNFTPrice`

0xdarko

Summary

LendingPool::getNFTPrice retrieves NFT prices without validating how old the price data is, potentially allowing the use of stale prices in lending decisions.

Vulnerability Details

[](https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/pools/LendingPool/LendingPool.sol#L591-L595)

The LendingPool::getNFTPrice function retrieves prices without checking their age:

function getNFTPrice(uint256 tokenId) public view returns (uint256) {
(uint256 price, uint256 lastUpdateTimestamp) = priceOracle.getLatestPrice(tokenId);
if (price == 0) revert InvalidNFTPrice();
// Missing staleness check
return price;
}

While the function retrieves the lastUpdateTimestamp, it doesn't use it to validate the freshness of the price data.

Impact

  • Stale prices could be used in lending calculations

  • Could lead to incorrect loan-to-value ratios

  • Financial impact through miss-priced loans

Tools Used

  • Manual code review

  • Control flow analysis

Recommendations

Add a staleness check with a configured threshold and create a new error:

+ error StalePrice();
​
+ uint256 public constant PRICE_STALENESS_THRESHOLD = 24 hours; // or whatever time you want
​
function getNFTPrice(uint256 tokenId) public view returns (uint256) {
(uint256 price, uint256 lastUpdateTimestamp) = priceOracle.getLatestPrice(tokenId);
if (price == 0) revert InvalidNFTPrice();
+ if (lastUpdateTimestamp == 0 || block.timestamp >= lastUpdateTimestamp + PRICE_STALENESS_THRESHOLD)
+ revert StalePrice();
return price;
}

Note: added lastUpdateTimestamp == 0 is extra incase it should revert if that value is 0

Updates

Lead Judging Commences

inallhonesty Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::getNFTPrice or getPrimeRate doesn't validate timestamp staleness despite claiming to, allowing users to exploit outdated collateral values during price drops

inallhonesty Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::getNFTPrice or getPrimeRate doesn't validate timestamp staleness despite claiming to, allowing users to exploit outdated collateral values during price drops

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.