Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

`LendingPool::getNFTPrice` doesn't check for stale prices, leading to wrong calculations

77SecMentees

Summary

The LendingPool::getNFTPricefunction query the NFT price and the time of the last update from the RAACHousePrice::tokenToHousePricethrough the getLatestPrice function. However, it doesn't check for staleness.

Vulnerability Details

The RAACHousePrice::getLatestPrice function returns the price and the lastUpdateTimestampbut the LendingPool::getNFTPrice only checks if the price is zero, which means if the price hasn't been updated for a long time, the function will always return an outdated price.

function getNFTPrice(uint256 tokenId) public view returns (uint256) {
(uint256 price, uint256 lastUpdateTimestamp) = priceOracle.getLatestPrice(tokenId);
if (price == 0) revert InvalidNFTPrice();
return price;
}

Impact

Users can borrow against outdated prices or even take advantage of outdated prices to avoid liquidations.

Tools Used

Code Review

Recommendations

Define a threshold and check against it to avoid stale prices.

function getNFTPrice(uint256 tokenId) public view returns (uint256) {
(uint256 price, uint256 lastUpdateTimestamp) = priceOracle.getLatestPrice(tokenId);
+ if(lastUpdateTimeStamp > THRESHOLD) revert();
if (price == 0) revert InvalidNFTPrice();
return price;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::getNFTPrice or getPrimeRate doesn't validate timestamp staleness despite claiming to, allowing users to exploit outdated collateral values during price drops

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::getNFTPrice or getPrimeRate doesn't validate timestamp staleness despite claiming to, allowing users to exploit outdated collateral values during price drops

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!