Submission Details
Severity:
Missing Staleness Check for Nft price
Summary
The getNFTPrice function retrieves an NFT price from the oracle but fails to verify the lastUpdateTimestamp, leaving the protocol vulnerable to stale or outdated price data.
Vulnerability Details
In the getNFTPrice function we get nft price from oracle but we do not check lastUpdateTimestamp for stale prices
/contracts/core/pools/LendingPool/LendingPool.sol:605
605: function getNFTPrice(uint256 tokenId) public view returns (uint256) {
606: (uint256 price, uint256 lastUpdateTimestamp) = priceOracle.getLatestPrice(tokenId);
607: if (price == 0) revert InvalidNFTPrice();
608: return price;
609: }
Impact
If the oracle data becomes outdated, relying on a stale price could lead to incorrect valuations.
Tools Used
Manual Review
Recommendations
Add staleness check as follow:
error StalePrice();
uint256 public constant MAX_PRICE_AGE = 24 hours;
diff --git a/contracts/core/pools/LendingPool/LendingPool.sol b/contracts/core/pools/LendingPool/LendingPool.sol
index e2d84c4..7fc75d0 100644
--- a/contracts/core/pools/LendingPool/LendingPool.sol
+++ b/contracts/core/pools/LendingPool/LendingPool.sol
contract LendingPool is ILendingPool, Ownable, ReentrancyGuard, ERC721Holder, Pa
// Allow to pause withdrawals
bool public withdrawalsPaused = false;
+ error StalePrice();
+ uint256 public constant MAX_PRICE_AGE = 24 hours;
// MODIFIERS
contract LendingPool is ILendingPool, Ownable, ReentrancyGuard, ERC721Holder, Pa
(uint256 price, uint256 lastUpdateTimestamp) = priceOracle.getLatestPrice(tokenId);
if (price == 0) revert InvalidNFTPrice();
+ if (block.timestamp < (lastUpdateTimestamp + MAX_PRICE_AGE)) {
+ revert StalePrice();
+ }
return price;
}
Updates
Lead Judging Commences
inallhonesty 7 months ago
Submission Judgement Published Assigned finding tags:
LendingPool::getNFTPrice or getPrimeRate doesn't validate timestamp staleness despite claiming to, allowing users to exploit outdated collateral values during price drops
inallhonesty 7 months ago
Submission Judgement Published Assigned finding tags:
LendingPool::getNFTPrice or getPrimeRate doesn't validate timestamp staleness despite claiming to, allowing users to exploit outdated collateral values during price drops
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420
USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.