Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Stale NFT Price Manipulation

rampage

Summary

Missing staleness check in price validation will cause financial losses for the protocol as malicious actors can exploit outdated NFT prices for collateral calculation.

Root Cause

In LendingPool.sol the getNFTPrice() function lacks validation for price staleness, allowing outdated prices to be used for collateral calculations.

function getNFTPrice(uint256 tokenId) public view returns (uint256) {
(uint256 price, uint256 lastUpdateTimestamp) = priceOracle.getLatestPrice(tokenId);
if (price == 0) revert InvalidNFTPrice();
return price;
}

Internal pre-conditions

  1. NFT price oracle needs to return stale price data that differs significantly from current market value

Attack Path

  1. Attacker waits for NFT market prices to decrease significantly

  2. Attacker uses stale (higher) price data from oracle for collateral calculations

  3. Protocol accepts overvalued collateral due to missing staleness validation

Impact

The protocol risks significant financial losses by accepting overvalued collateral based on stale prices. This could lead to undercollateralized positions when real NFT prices have decreased.

Mitigation

Add price staleness validation in getNFTPrice():

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::getNFTPrice or getPrimeRate doesn't validate timestamp staleness despite claiming to, allowing users to exploit outdated collateral values during price drops

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::getNFTPrice or getPrimeRate doesn't validate timestamp staleness despite claiming to, allowing users to exploit outdated collateral values during price drops

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!