Submission Details
Severity:
Unauthenticated Oracle Updates
Summary
Unauthenticated Oracle Updates leads to unfair liquidatioin
Vulnerability Details
RAACHousePriceOracle.updatePrice() lacks access controls, allowing arbitrary users to manipulate real estate valuations.
Impact
Incorrect prices lead to undercollateralized loans or unfair liquidations.
Tools Used
Manual Review
Recommendations
Before: Unrestricted
updatePrice
function updatePrice(uint newPrice) external { ... }
After: Restrict to trusted oracle nodes ex. Chainlink
function updatePrice(uint newPrice) external onlyOracleNode { ... }
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.