Core Contracts

Summary

The LendingPool doesn't check how old the NFTId price is.
The borrower can borrow against a stale colateral price or be liquidated unfairly.

Vulnerability Details

The admin can interogate the offchain price of a house NFTId by calling [BaseChainlinkFunctionsOracle::sendRequest]. When Chainlink process the request the token price is updated and the timestamp of the last price update is stored.

LendingPool::getNftPrice calls the RAACHousePrices::getLatestPrice to retrieve these informations.

The getLatestPrice function doesn't return the latest offchain price. Instead, it returns the price stored when the offchain price was requested and successfully fulfilled by Chainlink Functions.

The stored price returned by the getLatestPrice may be stale due to the following reasons :

• the price wasn't requested in the last X days;

• the request wasn't successfully fulfilled by Chainlink Functions last time when it was requested

When Chainlink Functions returns an error the old price is considered valid.
fulfillRequest doesn't handle the errors.

Impact

Borrowers may be liquidated unfairly.
Borrowers may borrow more than the collateral value.

Tools Used

Recommendations

A more robust price querying and price handling is required.
Consider the following changes:

• in getNftPrice if the last price update is older than a predefined X days, revert

• update the fulfillRequest to handle ChainlinkFunctions errors. The old stored price should not be considered valid.

• consider implementing a new permissionless function to allow users to requesting the offchain price OR consider to automate Chainlink Functions.