Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

NFT price returned from Oracle can be stale

damilolaedwards

Target

contracts/core/pools/LendingPool/LendingPool.sol

Vulnerability Details

The Oracle sets the house price for each token Id and set the last update time to the current timestamp.

function setHousePrice(
uint256 _tokenId,
uint256 _amount
) external onlyOracle {
tokenToHousePrice[_tokenId] = _amount;
lastUpdateTimestamp = block.timestamp;
emit PriceUpdated(_tokenId, _amount);
}

RAACHousePrices.setHousePrice

However when the current price of an NFT is been read from the oracle the function does not validate the returned lastUpdateTimestamp value, which could be stale (may not be updated for a long time).

function getNFTPrice(uint256 tokenId) public view returns (uint256) {
(uint256 price, uint256 lastUpdateTimestamp) = priceOracle.getLatestPrice(tokenId);
if (price == 0) revert InvalidNFTPrice();
return price;
}

LendingPool.getNFTPrice

Impact

Since collaterals are valued using the sum of the prices of NFT owned by the borrower, a borrower can be incorrectly subject to liquidation, as the assets may not be priced correctly leading to loss of fund for the user.

Tools Used

Manual Review

Recommendations

Add validation logic to validate the returned LastUpdateTimestamp value when reading the price of an NFT

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::getNFTPrice or getPrimeRate doesn't validate timestamp staleness despite claiming to, allowing users to exploit outdated collateral values during price drops

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::getNFTPrice or getPrimeRate doesn't validate timestamp staleness despite claiming to, allowing users to exploit outdated collateral values during price drops

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!