Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

House Price Oracle Update Problem

aksoy

Summary

The current implementation of the house price oracle allows for potential inconsistencies when updating house prices. The lastHouseId is updated with each new request, regardless of whether the previous request has been fulfilled. This can lead to incorrect price updates for house IDs, especially when multiple requests are made in quick succession.

Vulnerability Details

The lastHouseId is updated with every new request without checking if the previous request has been fulfilled. If owner send multiple reqeusts to update different ids before previous requests filled, pending request will update only last house. Also there is no check if requestId and house id match. So the last fulfilled request which could be

function _beforeFulfill(string[] calldata args) internal override {
lastHouseId = args[0].stringToUint();
}
​
/**
* @notice Process the response from the oracle
* @param response The response from the oracle
*/
function _processResponse(bytes memory response) internal override {
uint256 price = abi.decode(response, (uint256));
housePrices.setHousePrice(lastHouseId, price);
emit HousePriceUpdated(lastHouseId, price);
}

Since it is not known when the chainlink router will complete these requests, if multiple prices need to be updated immediately, this will not be possible.

Example Scenario

  1. Owner send requests:

    • h1 ->req1 , h2->req2, h3->req3

    • lastHouseId is set to h3.

  2. Requests fulfilled:

    • Requests are not filled in order .

    • req1-> updates lastHouseId[3]= price1

    • req3-> updates lastHouseId[3]= price3

    • req2-> updates lastHouseId[3]= price2

House1 , 2 prices not updated and House 3 is updated with different price.

Impact

If multiple requests are made, the price for a previous house ID might be incorrectly updated when the request is fulfilled.

Tools Used

Manual

Recommendations

Maintain a mapping of pending requests to ensure that each house ID is updated only when its specific request is fulfilled.

Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Oracle Race Condition in RAACHousePriceOracle causes price misassignment between NFTs

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Oracle Race Condition in RAACHousePriceOracle causes price misassignment between NFTs

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.