Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

getNFTPrice in LendingPool has no checks in place to check for stale prices

0xtimefliez

Description

LendingPool::getNFTPrice is supposed to check if the provided price for given NFT is current enough for any action relying on the function, and probably, if not, revert. Even though the natspec highlights this functionality, the function fails to implement this logic.

Vulnerable Code

LendingPool::getNftPrice

/**
* @notice Gets the current price of an NFT from the oracle
* @param tokenId The token ID of the NFT
* @return The price of the NFT
*
@> * Checks if the price is stale
*/
function getNFTPrice(uint256 tokenId) public view returns (uint256) {
@> (uint256 price, uint256 lastUpdateTimestamp) = priceOracle.getLatestPrice(tokenId);
if (price == 0) revert InvalidNFTPrice();
@> // Here should be some sort of a staleness check
return price;
}

As you can see in the natspec and the code, the function should perform a staleness check, fetched the lastUpdateTimestamp but in the end, no checks on the staleness are performed.

Impact

No stale data check can leave the property not updated for extensive periods of time. The impact arising is, that the NFT could have gained or lost value since it was last updated, but since no timeframe is enforced the last update could be weeks, months, years or decades old. The result of this is that the real fair value of this NFT might be over- or underestimated in current state, so either a user which would be due to liquidation would not be liquidatable or potentially missing out on gains his NFT would usually have provided. Either way, the protocol should implement proposed staleness check from the natspec to ensure that no action regarding the NFT can be taken until the price is evaluated in a current past, to prevent harm from protocol or user.

Tools Used

Manual Review

Recommended Mitigation

+ uint256 public maxStaleness;
function getNFTPrice(uint256 tokenId) public view returns (uint256) {
(uint256 price, uint256 lastUpdateTimestamp) = priceOracle.getLatestPrice(tokenId);
if (price == 0) revert InvalidNFTPrice();
+ if (block.timestamp - lastUpdateTimestamp > maxStaleness) {
+ // Do Something;
+ }
return price;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::getNFTPrice or getPrimeRate doesn't validate timestamp staleness despite claiming to, allowing users to exploit outdated collateral values during price drops

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::getNFTPrice or getPrimeRate doesn't validate timestamp staleness despite claiming to, allowing users to exploit outdated collateral values during price drops

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.