Core Contracts

Summary

getNFTPrice(tokenId) trusts a single oracle price without validating price stability.

Attackers can manipulate the price using flash loans or oracle attacks.

Vulnerability Details

function getNFTPrice(uint256 tokenId) public view returns (uint256) {

(uint256 price, uint256 lastUpdateTimestamp) = priceOracle.getLatestPrice(tokenId);

if (price == 0) revert InvalidNFTPrice();
return price;
}

Impact

Tools Used

Recommendations

Use TWAP (Time-Weighted Average Price) instead of a single price fetch.

Implement sanity checks for price variations.

function getNFTPrice(uint256 tokenId) public view returns (uint256)

{ (uint256 price, uint256 lastUpdateTimestamp) = priceOracle.getLatestPrice(tokenId);

if (price == 0) revert InvalidNFTPrice();

if (block.timestamp - lastUpdateTimestamp > MAX_PRICE_UPDATE_DELAY) revert PriceOutdated();

return price; }