Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

RAACNFT prices are taken in USD amount when being minted resulting in invalid protocol calculations

056Security

Summary

Based on the code documentation RAACNFT prices are stored in USD amount. However, this amount is not converted to a value to match the crvUSD decimals. This allows users to mint assets at an extremely low price. What is more, this price is also used to calculate user collateral which is compared to debt (again in e18decimals), resulting in invalid collateral level checks.

Vulnerability Details

The code suggests using a mapping from tokenId to USD value:

contract RAACHousePrices is Ownable {
/// @notice Mapping from RAAC tokenId to house price in USD
mapping(uint256 => uint256) public tokenToHousePrice;
address public oracle;

If the above is taken as a source of truth, this means that, when NFTs are minted, users will deposit USD amount of crvUSD:

function mint(uint256 _tokenId, uint256 _amount) public override {
uint256 price = raac_hp.tokenToHousePrice(_tokenId);
if(price == 0) { revert RAACNFT__HousePrice(); }
if(price > _amount) { revert RAACNFT__InsufficientFundsMint(); }
​
// transfer erc20 from user to contract - requires pre-approval from user
@> token.safeTransferFrom(msg.sender, address(this), _amount); // @audit - if the amount is in USD format as specified in HoisePrice contract, then users will pay dust amount of crvUSD
​
// mint tokenId to user
_safeMint(msg.sender, _tokenId);
​
// If user approved more than necessary, refund the difference
if (_amount > price) {
uint256 refundAmount = _amount - price;
token.safeTransfer(msg.sender, refundAmount);
}
​
emit NFTMinted(msg.sender, _tokenId, price);
}

What is more, every collateral check in the LendingPool will compare debt (e18) to collateral (USD decimals), leading to invalid calculations.

Impact

Breaking core protocol functionality.

Tools Used

Manual review

Recommendations

When setting the home prices carefully scale the decimals to the right amount.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!