Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

RAACHousePrices doesn't maintain last update timestamp for tokens individually

unitedcoolness26

Summary

RAACHousePrices contract does not maintain different lastUpdateTimestamps for different tokens. It updates the same storage variable whenever the price of a house is updated, which returns wrong data to the viewers when getLatestPrice function is called.

Vulnerability Details

RAACHousePrices::setHousePrice function updates the storage variable lastUpdateTimestamp on being called. But according to the function's description, it should update timestamp for each token individually.

RAACHousePrices::getLatestPrice function should also return the token-specific update timestamp, according to its description. But it returns lastUpdateTimestamp, which is not token-specific.

Impact

  • Wrong information obtained on calling RAACHousePrices::getLatestPrice

Recommendations

Use a mapping for last update timestamps

--- a/contracts/core/primitives/RAACHousePrices.sol
+++ b/contracts/core/primitives/RAACHousePrices.sol
@@ -14,7 +14,7 @@ contract RAACHousePrices is Ownable {
address public oracle;
/// @notice Timestamp of the last price update
- uint256 public lastUpdateTimestamp;
+ mapping(uint256 => uint256) public lastUpdateTimestamp;
/// @notice Emitted when a price is updated
event PriceUpdated(uint256 tokenId, uint256 newPrice);
@@ -34,7 +34,7 @@ contract RAACHousePrices is Ownable {
function getLatestPrice(
uint256 _tokenId
) external view returns (uint256, uint256) {
- return (tokenToHousePrice[_tokenId], lastUpdateTimestamp);
+ return (tokenToHousePrice[_tokenId], lastUpdateTimestamp[_tokenId]);
}
constructor(address initialOwner) Ownable(initialOwner) {}
@@ -51,7 +51,7 @@ contract RAACHousePrices is Ownable {
uint256 _amount
) external onlyOracle {
tokenToHousePrice[_tokenId] = _amount;
- lastUpdateTimestamp = block.timestamp;
+ lastUpdateTimestamp[_tokenId] = block.timestamp;
emit PriceUpdated(_tokenId, _amount);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACHousePrices uses a single global lastUpdateTimestamp for all NFTs instead of per-token tracking, causing misleading price freshness data

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACHousePrices uses a single global lastUpdateTimestamp for all NFTs instead of per-token tracking, causing misleading price freshness data

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.