Submission Details
Severity:
`RAACHousePrices.sol` incorrect design of last update time.
Summary
The pricing for ERC-721 is different from that of ERC-20, and it should record the timestamp of the last update for each token ID.
Vulnerability Details
All token IDs share a timestamp variable for the last update. When calling getLatestPrice, its lastUpdateTimestamp might be the lastUpdateTimestamp of a different token ID.
/// @dev https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/primitives/RAACHousePrices.sol#L11
contract RAACHousePrices is Ownable {
/// @notice Timestamp of the last price update
uint256 public lastUpdateTimestamp;
function getLatestPrice(
uint256 _tokenId
) external view returns (uint256, uint256) {
return (tokenToHousePrice[_tokenId], lastUpdateTimestamp);
}
function setHousePrice(
uint256 _tokenId,
uint256 _amount
) external onlyOracle {
tokenToHousePrice[_tokenId] = _amount;
lastUpdateTimestamp = block.timestamp;
emit PriceUpdated(_tokenId, _amount);
}
}
Impact
As long as one token ID has its price updated, other token IDs with outdated prices can bypass the staleness check.
Tools Used
Manual.
Recommendations
contract RAACHousePrices is Ownable {
// tokenId => timestamp
mapping(uint256 => uint256) public lastUpdateTimestamp;
function setHousePrice(
uint256 _tokenId,
uint256 _amount
) external onlyOracle {
tokenToHousePrice[_tokenId] = _amount;
lastUpdateTimestamp[_tokenId] = block.timestamp;
emit PriceUpdated(_tokenId, _amount);
}
}
Updates
Lead Judging Commences
inallhonesty 7 months ago
Submission Judgement Published Assigned finding tags:
RAACHousePrices uses a single global lastUpdateTimestamp for all NFTs instead of per-token tracking, causing misleading price freshness data
inallhonesty 7 months ago
Submission Judgement Published Assigned finding tags:
RAACHousePrices uses a single global lastUpdateTimestamp for all NFTs instead of per-token tracking, causing misleading price freshness data
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420
USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.