Core Contracts

Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Submission Details
Severity: low
Valid

Incorrect Timestamp Tracking

Summary

In summary, the current implementation incorrectly uses a single timestamp for all tokens, which does not align with the documentation claiming to provide token-specific timestamps. By implementing a mapping for individual token timestamps, you can ensure that users receive accurate information about when each token's price was last updated. This change will enhance the clarity and functionality of the contract.

Current Implementation

In the current implementation, there is a single state variable:

uint256 public lastUpdateTimestamp;

This variable is intended to store the timestamp of the last price update. However, it is a global variable that applies to all tokens managed by the contract.

Problem

The problem arises in the getLatestPrice function:

function getLatestPrice(uint256 _tokenId) external view returns (uint256, uint256) {
return (tokenToHousePrice[_tokenId], lastUpdateTimestamp);
}

Here, when a user calls getLatestPrice for a specific token ID, the function returns the price of that token along with the lastUpdateTimestamp. However, this timestamp does not reflect when the price for that specific token was last updated. Instead, it reflects the last time any token's price was updated.

Misleading Documentation

The documentation for the getLatestPrice function states:

/**
* @notice Retrieves the latest price and update timestamp for a given token
* @param _tokenId The ID of the RAAC token
* @return The latest price and the timestamp of the last update
*
* Returns token-specific update timestamp
*/

This comment implies that the function returns a timestamp specific to the token identified by _tokenId. However, since lastUpdateTimestamp is a single global variable, it does not provide a token-specific timestamp. This discrepancy can lead to confusion for users of the contract, as they might expect the timestamp to reflect the last update for the specific token they are querying.

Suggested Solution

To resolve this issue, you should implement a mapping that tracks the last update timestamp for each token individually. For example:

mapping(uint256 => uint256) public tokenToLastUpdateTimestamp;

Then, in the setHousePrice function, you would update this mapping whenever a token's price is set:

tokenToLastUpdateTimestamp[_tokenId] = block.timestamp;

Finally, you would modify the getLatestPrice function to return the specific timestamp for the queried token:

return (tokenToHousePrice[_tokenId], tokenToLastUpdateTimestamp[_tokenId]);
Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACHousePrices uses a single global lastUpdateTimestamp for all NFTs instead of per-token tracking, causing misleading price freshness data

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACHousePrices uses a single global lastUpdateTimestamp for all NFTs instead of per-token tracking, causing misleading price freshness data

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.