Submission Details
Severity:
Unauthenticated Oracle Updates
Author Revealed upon completion
Summary
Unauthenticated Oracle Updates leads to unfair liquidatioin
Vulnerability Details
RAACHousePriceOracle.updatePrice() lacks access controls, allowing arbitrary users to manipulate real estate valuations.
Impact
Incorrect prices lead to undercollateralized loans or unfair liquidations.
Tools Used
Manual Review
Recommendations
Before: Unrestricted
updatePrice
function updatePrice(uint newPrice) external { ... }
After: Restrict to trusted oracle nodes ex. Chainlink
function updatePrice(uint newPrice) external onlyOracleNode { ... }
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
View preliminary resultsAppeals Review
Appeals are being carefully reviewed by our judges.
Rewards Distribution
The contest is complete and the rewards are being distributed.