Core Contracts

Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Submission Details
Severity: low
Valid

Fail to update token's timestamp for each token individually

Summary

Fail to update token's timestamp for each token individually

Vulnerability Details

In RAACHousePrices, we will update the RWA asset's price. According to the comment in the function setHousePrice, we wish to update the RWA assets' price timestamp individually. The reason that we need token's timestamp individually, we can make use of the individual token's timestamp to check whether the RWA's price is stale or not. This is important to make sure that we should not use one stale price to trade in RAAC.

The problem is that we fail to update the RWA assets' price timestamp individually. This will cause that we cannot check the stale price correctly with this global lastUpdateTimestamp.

/**
* @notice Allows the owner to set the house price for a token
* @param _tokenId The ID of the RAAC token
* @param _amount The price to set for the house in USD
*
* Updates timestamp for each token individually
*/
function setHousePrice(
uint256 _tokenId,
uint256 _amount
) external onlyOracle {
tokenToHousePrice[_tokenId] = _amount;
lastUpdateTimestamp = block.timestamp;
emit PriceUpdated(_tokenId, _amount);
}

Impact

Fail to implement updating timestamp for each token individually. This will cause that we cannot check each RWA asset's price is stale or not.

Tools Used

Manual

Recommendations

Use one mapping variable to store different NFT's price timestamp.

Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACHousePrices uses a single global lastUpdateTimestamp for all NFTs instead of per-token tracking, causing misleading price freshness data

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACHousePrices uses a single global lastUpdateTimestamp for all NFTs instead of per-token tracking, causing misleading price freshness data

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.