Core Contracts

Summary

The function to get NFT price in lending pool does not check the staleness of the price which could lead to outdated prices of NFT being used on the lending pool.

Vulnerability Details

Below is a snippet of the getNFTPricefunction in LendingPool.sol

As seen above, the function return the price without making use of the lastUpdateTimestampvariable which can be used to check the staleness of price.

Impact

The getNFTPricefunction is used to check in the getUserCollateralValuefunction to calculate a user's collateral value which is used to determine whether a user is allowed to borrow and whether the user can be liquidated.

If the outdated price is higher than the current price:

Borrowers may appear to have more collateral than they actually do, allowing them to take out larger loans than they should be eligible for.

When an NFT’s actual market value drops but the system continues to use an outdated, higher price, borrowers who should be liquidated may not be. This delay in liquidation can allow unhealthy debt positions to persist, ultimately threatening the overall solvency of the lending pool.

This also creates exploitable arbitrage opportunities. Malicious actors could manipulate the system by borrowing assets against stale, inflated NFT prices, withdrawing their borrowed funds, and defaulting once the price updates to reflect the true lower value.

All this could eventually result in significant bad debt being accumulated within the system.

If the outdated price is lower than the current price:

Borrowers may be prevented from accessing the full loan amount they’re eligible for. This results in inefficient capital use and discourages participation.

This can also cause premature liquidations, where borrowers lose their NFTs unfairly due to incorrect pricing.

This can also slow down liquidations as liquidators may avoid liquidating the users if they see an outdated lower price, fearing overpayment.

Tools Used

Manual review

Recommendations

Make use of lastUpdateTimestampto check the staleness of the price against a staleness threshold.