Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Lack of Stale Price Check in LendingPool::getNFTPrice()

josh4324

Summary

The getNFTPrice() function retrieves the latest price of an NFT using an external price oracle. However, it does not check if the price is stale, which means outdated prices can be used for calculations, leading to inaccurate collateral valuations.

Vulnerability Details

function getNFTPrice(uint256 tokenId) public view returns (uint256) {
(uint256 price, uint256 lastUpdateTimestamp) = priceOracle.getLatestPrice(tokenId);
if (price == 0) revert InvalidNFTPrice();
return price;
}
​

The function does not check whether lastUpdateTimestamp is recent. If the oracle stops updating prices or experiences delays, the function might return outdated NFT prices.

This can result in incorrect collateral valuations, leading to liquidations based on outdated prices or allowing undercollateralized loans.

Impact

Users may be liquidated unfairly if the oracle price is outdated.

Borrowers can take loans with insufficient collateral if the price was higher when last updated.

Tools Used

Manual Review

Recommendations

The function should validate that the price is recent by comparing lastUpdateTimestamp with block.timestamp.

Introduce a maximum price age (staleThreshold) to define when a price is considered outdated.

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::getNFTPrice or getPrimeRate doesn't validate timestamp staleness despite claiming to, allowing users to exploit outdated collateral values during price drops

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::getNFTPrice or getPrimeRate doesn't validate timestamp staleness despite claiming to, allowing users to exploit outdated collateral values during price drops

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.