Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Incorrect Timestamp Handling in RAACHousePrices::getLatestPrice()

josh4324

Summary

The price oracle contract allows storing and retrieving the latest price of tokens (e.g., NFTs or assets). However, the lastUpdateTimestamp is stored globally instead of per token.

This means that when any token’s price is updated, all tokens appear to have been updated at the same time, even if their prices remain unchanged.

Vulnerability Details

/// @notice Timestamp of the last price update
uint256 public lastUpdateTimestamp;
​
function getLatestPrice(
uint256 _tokenId
) external view returns (uint256, uint256) {
return (tokenToHousePrice[_tokenId], lastUpdateTimestamp); // ❌ Incorrect: shared timestamp
}
​
function setHousePrice(
uint256 _tokenId,
uint256 _amount
) external onlyOracle {
tokenToHousePrice[_tokenId] = _amount;
lastUpdateTimestamp = block.timestamp; // ❌ Incorrect: Updates for all tokens
emit PriceUpdated(_tokenId, _amount);
}
​

The lastUpdateTimestamp should reflect when each individual token’s price was last updated.

Currently, if any token price is updated, the timestamp changes for all tokens, even if they were never updated.

Impact

getLatestPrice will always return incorrect lastUpdateTimestamp, which will allow stale data to be perceived as updated data.

Tools Used

Manual Review

Recommendations

Store Individual Timestamps Per Token

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACHousePrices uses a single global lastUpdateTimestamp for all NFTs instead of per-token tracking, causing misleading price freshness data

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACHousePrices uses a single global lastUpdateTimestamp for all NFTs instead of per-token tracking, causing misleading price freshness data

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.