Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Missing timestamp validation in `RAACHousePrices`

falendar

Summary

The RAACHousePrices contract lacks proper timestamp validation for house prices, allowing stale prices to be used in critical operations like lending and borrowing. The contract returns prices without indicating their age or freshness, which could lead to the protocol operating on outdated price data.

Vulnerability Details

Theere is no validation of price age before use:

function getLatestPrice(
uint256 _tokenId
) external view returns (uint256, uint256) {
return (tokenToHousePrice[_tokenId], lastUpdateTimestamp);
}

Example attack scenario:

  1. Day 1 - price updated:

    • tokenToHousePrice[1] = 500_000 * 10**18; ($500k)

    • lastUpdateTimestamp = 1708444800; (Feb 20, 2024)

  2. Day 30 - oracle stops working:

    • price still usable despite being 30 days old

    • getLatestPrice[1] returns (500_000 * 10**18, 1708444800)

  3. Attacker can:

    • wait for price to become stale

    • take out loan when market price has dropped

    • profit from price difference

Impact

High: Risk of protocol insolvency if many loans use outdated valuations.

Recommendations

Consider implementing price staleness checks:

+ uint256 public constant PRICE_STALENESS_THRESHOLD = 7 days;
​
function getLatestPrice(
uint256 _tokenId
) external view returns (uint256, uint256) {
+ require(block.timestamp - lastUpdateTimestamp <= PRICE_STALENESS_THRESHOLD, "Stale Price");
return (tokenToHousePrice[_tokenId], lastUpdateTimestamp);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::getNFTPrice or getPrimeRate doesn't validate timestamp staleness despite claiming to, allowing users to exploit outdated collateral values during price drops

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::getNFTPrice or getPrimeRate doesn't validate timestamp staleness despite claiming to, allowing users to exploit outdated collateral values during price drops

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.