Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Untrusted Oracle Data - RAACHousePriceOracle.sol

jefextar

Summary

RAACHousePriceOracle lacks validation mechanisms for oracle responses, allowing malicious or faulty data to update house prices.

Vulnerability Details

_processResponse uses abi.decode without validation, trusting the oracle’s raw data. If the oracle is compromised or sends invalid values (e.g., 0 or astronomically high prices), it corrupts the system.

Impact

Malicious price updates can manipulate collateral values and trigger liquidations or undercollateralized loans.

Tools Used

  • Slither/Mythril: Identifies missing data validation.

  • Manual Audit: Review of response handling logic.

Recommendations

Validate the price before updating.

function _processResponse(bytes memory response) internal override {
uint256 price = abi.decode(response, (uint256));
require(price > 0 && price <= maxValidPrice, "Invalid price");
housePrices.setHousePrice(lastHouseId, price);
emit HousePriceUpdated(lastHouseId, price);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.