Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

`LendingPool::getNFTPrice()` can use outdated and stale price

s4muraii77

Summary

LendingPool::getNFTPrice() can use outdated and stale price

Vulnerability Details

LendingPool::getNFTPrice() has the following code:

* Checks if the price is stale
*/
function getNFTPrice(uint256 tokenId) public view returns (uint256) {
(uint256 price, uint256 lastUpdateTimestamp) = priceOracle.getLatestPrice(tokenId);
if (price == 0) revert InvalidNFTPrice();
return price;
}

This calls the following function:

function getLatestPrice(
uint256 _tokenId
) external view returns (uint256, uint256) {
return (tokenToHousePrice[_tokenId], lastUpdateTimestamp);
}

Firstly, the getNFTPrice() has a comment above the function which mentions that it checks the price is not stale. However, the only check is that the price is not 0 which does not, at all, guarantee that the price is fresh. Secondly, we are using cached values in the contract which can be very old, this will result in potentially using stale prices. This can also be abused by frontrunning the price update if the price will decrease, by taking use of the currently higher prices.

Impact

Prices can be stale as no check disallows it

Tools Used

Manual Review

Recommendations

Implement a staleness check

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::getNFTPrice or getPrimeRate doesn't validate timestamp staleness despite claiming to, allowing users to exploit outdated collateral values during price drops

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::getNFTPrice or getPrimeRate doesn't validate timestamp staleness despite claiming to, allowing users to exploit outdated collateral values during price drops

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.