Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Oracle price staleness check missing in critical functions

patitonar

Summary

The protocol lacks validation of oracle price staleness in critical functions where house prices are fetched. Specifically:

  1. In RAACNFT::mint(), tokenToHousePrice() is called without checking the timestamp of the last price update

  2. In LendingPool::getNFTPrice(), while getLatestPrice() returns a timestamp, it's not validated against any staleness threshold
    This could allow operations to proceed with severely outdated price data, potentially leading to significant financial losses.

Impact

Stale prices can be exploited to:

  • Mint NFTs at outdated (potentially lower) prices

  • Take out loans with incorrect collateral valuations

  • Manipulate liquidation thresholds

In volatile market conditions, using stale prices could result in direct financial losses to users and the protocol.

Tools Used

Manual review

Recommendations

Add staleness checks when fetching oracle prices:

In RAACNFT::mint():

function mint(uint256 _tokenId, uint256 _amount) public override {
- uint256 price = raac_hp.tokenToHousePrice(_tokenId);
+ (uint256 price, uint256 lastUpdateTimestamp) = raac_hp.getLatestPrice(_tokenId);
if(price == 0) { revert RAACNFT__HousePrice(); }
+ if(block.timestamp - lastUpdateTimestamp > MAXIMUM_PRICE_STALENESS) { revert RAACNFT__StalePrice(); }
if(price > _amount) { revert RAACNFT__InsufficientFundsMint(); }
// ... rest of the function
}

In LendingPool::getNFTPrice():

function getNFTPrice(uint256 tokenId) public view returns (uint256) {
(uint256 price, uint256 lastUpdateTimestamp) = priceOracle.getLatestPrice(tokenId);
if (price == 0) revert InvalidNFTPrice();
+ if(block.timestamp - lastUpdateTimestamp > MAXIMUM_PRICE_STALENESS) revert LendingPool__StalePrice();
return price;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::getNFTPrice or getPrimeRate doesn't validate timestamp staleness despite claiming to, allowing users to exploit outdated collateral values during price drops

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::getNFTPrice or getPrimeRate doesn't validate timestamp staleness despite claiming to, allowing users to exploit outdated collateral values during price drops

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.