Submission Details
Severity:
Staleness of NFT price is not checked.
Summary
Contract - LendingPool.sol
function getNFTPrice(uint256 tokenId) public view returns (uint256) {
(uint256 price, uint256 lastUpdateTimestamp) = priceOracle.getLatestPrice(tokenId);
// @audit - it's not checking staleness of price, by leveraging lastUpdateTimestamp.
if (price == 0) revert InvalidNFTPrice();
return price;
}
It's fetching lastUpdateTimestamp but not cheaking w.r.t heartbeat of oracle.
Vulnerability Details
It can lead to stale price return, if the feed not updated frequently.
Impact
Wrong NFT price fetching from oracle.
Tools Used
Manual
Recommendations
verify lastUpdateTimestamp w.r.t heartbeat of oracle feed.
Updates
Lead Judging Commences
inallhonesty 3 months ago
Submission Judgement Published Assigned finding tags:
LendingPool::getNFTPrice or getPrimeRate doesn't validate timestamp staleness despite claiming to, allowing users to exploit outdated collateral values during price drops
inallhonesty 3 months ago
Submission Judgement Published Assigned finding tags:
LendingPool::getNFTPrice or getPrimeRate doesn't validate timestamp staleness despite claiming to, allowing users to exploit outdated collateral values during price drops
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.