Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Global Timestamp Mismanagement (Root Cause: Shared Timestamp Variable + Impact: Misleading Price Update Information)

pablitoamaral

Vulnerability Details

The RAACHousePrices contract uses a single global variable lastUpdateTimestamp to track the last price update time for all tokens. This design flaw causes the timestamp to update for every token price change, regardless of which specific token was modified. As a result, the function getLatestPrice returns the same timestamp for all tokens, misleading users into believing that all token prices were updated simultaneously.

Impact

Misleading Information: Users querying the price of tokens that have not been recently updated may receive a timestamp suggesting otherwise.

Operational Risk: DApps or financial applications relying on accurate price updates could make incorrect decisions based on outdated data, leading to potential financial loss.

PoC

  1. The oracle updates the price of token #1, setting lastUpdateTimestamp to T1.

  2. No updates are made to token #2.

  3. A user queries getLatestPrice(2) and receives the price along with the timestamp T1, giving the false impression that token #2's price was updated at T1.

Tools Used

Manual

Recommendations

Implement a per-token timestamp mapping to track the last update time of each token individually. This ensures that getLatestPrice returns accurate and token-specific timestamps.

+ mapping(uint256 => uint256) public tokenUpdateTimestamp;
​
function setHousePrice(
uint256 _tokenId,
uint256 _amount
) external onlyOracle {
tokenToHousePrice[_tokenId] = _amount;
+ tokenUpdateTimestamp[_tokenId] = block.timestamp; // Token-specific timestamp
emit PriceUpdated(_tokenId, _amount);
}
​
function getLatestPrice(
uint256 _tokenId
) external view returns (uint256 price, uint256 updateTimestamp) {
+ return (tokenToHousePrice[_tokenId], tokenUpdateTimestamp[_tokenId]);
}
​
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACHousePrices uses a single global lastUpdateTimestamp for all NFTs instead of per-token tracking, causing misleading price freshness data

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACHousePrices uses a single global lastUpdateTimestamp for all NFTs instead of per-token tracking, causing misleading price freshness data

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!