Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

`token` used in RAACNFT contract cannot be modified, which can lead to incorrect price computation if the oracle uses another token to price houses.

tadev

Summary

Currently, RAACNFT contract defines a token storage variable that is set in the constructor:

IERC20 public token;
​
...
​
constructor(address _token, address _housePrices, address initialOwner)
ERC721("RAAC NFT", "RAACNFT")
Ownable(initialOwner)
{
if (_token == address(0) || _housePrices == address(0) || initialOwner == address(0)) {
revert RAACNFT__InvalidAddress();
}
token = IERC20(_token);
raac_hp = IRAACHousePrices(_housePrices);
}

This token contract interface corresponds to the token in which prices are returned with the house price oracle (probably a stablecoin, but not information in the documentation).

The problem arises because there is no function that allows to modify token value. This means in case of an issue with the current stablecoin/token used to buy houses (and knowing that many stablecoin have collapsed in the past), contract make become unusable.

Impact

The impact of this issue can be considered as medium, as it can lead to futur problem for emitting new RAAC NFTs if the underlying token to buy these houses is not used anymore.

Tools Used

Manual review

Recommendations

Make sure to include a function with access control to allow changing the token used to buy RAAC NFTs.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!