Submission Details
Severity:
Insecure Price Oracle Integration - LendingPool.sol
Summary
The price oracle for NFTs lacks staleness checks, enabling manipulation of collateral valuations.
Vulnerability Details
priceOracle.getLatestPrice only checks price == 0, not staleness. Attackers could exploit outdated prices to undercollateralize borrows or trigger unfair liquidations.
Impact
Malicious actors could front-run NFT valuations or manipulate collateral ratios.
Tools Used
Manual Review: Validate oracle price validation logic.
Hardhat Tests: Simulate stale prices during borrowing/liquidation.
Recommendations
Add time checks to getNFTPrice
if (lastUpdateTimestamp > block.timestamp - 1 hours) {
return price;
} else {
revert("Price is stale");
}
Updates
Lead Judging Commences
inallhonesty 4 months ago
Submission Judgement Published Assigned finding tags:
LendingPool::getNFTPrice or getPrimeRate doesn't validate timestamp staleness despite claiming to, allowing users to exploit outdated collateral values during price drops
inallhonesty 4 months ago
Submission Judgement Published Assigned finding tags:
LendingPool::getNFTPrice or getPrimeRate doesn't validate timestamp staleness despite claiming to, allowing users to exploit outdated collateral values during price drops
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.