Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

`lastUpdateTimestamp` is returned from oracle but never checked which could lead to stale NFT prices

greese

Summary

The price of the NFT users deposit is used to calculate the total amount of collateral they have deposited. The values of these NFTs are fetched through a Chainlink price oracle. An issue arises because the timestamp of which these prices were last updated is never checked which could lead to a stale price.

Vulnerability Details

A user wishes to withdraw their NFT but they must not be undercollateralized. The price of their assets are fetched through getNFTPrice which will make a call to a Chainlink price oracle and add them all up together. The issue is that the lastUpdateTimestamp is never checked to ensure the price of the NFT isn't stale. A user may be denied a withdrawal or even be wrongfully liquidated because the current price of the NFTs are not up to date.

/**
* @notice Gets the current price of an NFT from the oracle
* @param tokenId The token ID of the NFT
* @return The price of the NFT
*
* Checks if the price is stale
*/
function getNFTPrice(uint256 tokenId) public view returns (uint256) {
(uint256 price, uint256 lastUpdateTimestamp) = priceOracle.getLatestPrice(tokenId);
if (price == 0) revert InvalidNFTPrice();
return price;
}

Impact

Users can be wrongfully liquidated due to outdated prices or prevent withdrawal

Tools Used

Manual Review

Recommendations

Check the last update timestamp

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::getNFTPrice or getPrimeRate doesn't validate timestamp staleness despite claiming to, allowing users to exploit outdated collateral values during price drops

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::getNFTPrice or getPrimeRate doesn't validate timestamp staleness despite claiming to, allowing users to exploit outdated collateral values during price drops

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.