Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

` LendingPool::getNFTPrice` Doesn't Check For Stale Prices Leading To Potential Collateral Misvaluation

kvltbyte

Summary

The LendingPool contract uses NFT prices for collateral valuation but fails to check if the price data is stale. This can lead to users borrowing more than they should by exploiting outdated NFT prices.

Description

The contract’s getNFTPrice function retrieves both the price and a timestamp from an external price oracle, but it only verifies that the price is nonzero. There is no validation of the age of the price data, allowing stale (or potentially manipulated) prices to be used for critical collateral calculations.

function getNFTPrice(uint256 tokenId) public view returns (uint256) {
(uint256 price, uint256 lastUpdateTimestamp) = priceOracle.getLatestPrice(tokenId);
@> if (price == 0) revert InvalidNFTPrice();
return price;
}

Impact

  • Over-Borrowing: Users might borrow excessive funds by relying on outdated NFT prices.

  • Under-collateralization: Loans may become under-collateralized if the NFT values used are not current.

  • Liquidation Risks: Incorrect collateral valuation could delay or improperly trigger liquidations, destabilizing the protocol.

Recommendations

  • Implement a Staleness Check: Modify the getNFTPrice function to verify that the price data is recent

+uint256 constant MAX_PRICE_AGE = 1 days;
​
function getNFTPrice(uint256 tokenId) public view returns (uint256) {
(uint256 price, uint256 lastUpdateTimestamp) = priceOracle.getLatestPrice(tokenId);
if (price == 0) revert InvalidNFTPrice();
+ if (block.timestamp - lastUpdateTimestamp > MAX_PRICE_AGE) revert PriceDataStale();
return price;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::getNFTPrice or getPrimeRate doesn't validate timestamp staleness despite claiming to, allowing users to exploit outdated collateral values during price drops

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::getNFTPrice or getPrimeRate doesn't validate timestamp staleness despite claiming to, allowing users to exploit outdated collateral values during price drops

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.