Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Missing Stale Price Check for Oracle Price in `LendingPool::getNFTPrice()`

gajiknownnothing

Summary

The LendingPool::getNFTPrice() function is intended to fetch the current price of an NFT from the oracle and check if the price is stale. However, the function does not implement the stale price check, as indicated in its comments. This omission can lead to inaccurate collateral valuation, causing protocol bad debts or unfair liquidations.

Vulnerability Details

The getNFTPrice() function retrieves the latest price and timestamp from the oracle but does not validate whether the price is stale (i.e., whether the lastUpdateTimestamp is within an acceptable time window).

/**
* @notice Gets the current price of an NFT from the oracle
* @param tokenId The token ID of the NFT
* @return The price of the NFT
*
> * Checks if the price is stale
*/
function getNFTPrice(uint256 tokenId) public view returns (uint256) {
(uint256 price, uint256 lastUpdateTimestamp) = priceOracle.getLatestPrice(tokenId);
if (price == 0) revert InvalidNFTPrice();
return price;
}

Impact

  1. Overestimated Prices: If the price is stale and higher than the actual market value, users can borrow more assets than their collateral is worth, leading to protocol bad debts.

  2. Underestimated Prices: If the price is stale and lower than the actual market value, users' health factors may fall below the liquidation threshold, causing unfair liquidations.

Tools Used

vscode

Recommendations

Add a stale price check to ensure the lastUpdateTimestamp is within an acceptable time window.

Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::getNFTPrice or getPrimeRate doesn't validate timestamp staleness despite claiming to, allowing users to exploit outdated collateral values during price drops

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::getNFTPrice or getPrimeRate doesn't validate timestamp staleness despite claiming to, allowing users to exploit outdated collateral values during price drops

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.