Core Contracts

Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Submission Details
Severity: low
Valid

Inaccurate Update Timestamp for Token Prices

01. Relevant GitHub Links

02. Summary

The getLatestPrice function returns a timestamp that is updated globally for any token price change. This results in the function returning an incorrect timestamp when querying specific token IDs.

03. Vulnerability Details

/**
* @notice Retrieves the latest price and update timestamp for a given token
* @param _tokenId The ID of the RAAC token
* @return The latest price and the timestamp of the last update
*
* Returns token-specific update timestamp
*/
function getLatestPrice(
uint256 _tokenId
) external view returns (uint256, uint256) {
return (tokenToHousePrice[_tokenId], lastUpdateTimestamp);
}
  • The contract stores only one lastUpdateTimestamp for all tokens.

  • Whenever any token’s price is updated, the single lastUpdateTimestamp is overwritten.

  • Calling getLatestPrice(_tokenId) retrieves the correct price for the given _tokenId but an irrelevant timestamp that might correspond to a different token’s update event.

04. Impact

Users or external contracts relying on token-specific timestamps may be misled by this global timestamp. This could cause confusion or errors in scenarios where accurate token price update times are critical for business logic or audits.

05. Tools Used

Manual Code Review and Foundry

06. Recommended Mitigation

  • Introduce a mapping that stores an individual updateTimestamp for each token ID.

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACHousePrices uses a single global lastUpdateTimestamp for all NFTs instead of per-token tracking, causing misleading price freshness data

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACHousePrices uses a single global lastUpdateTimestamp for all NFTs instead of per-token tracking, causing misleading price freshness data

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.