Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Protocol assumes stable coin to always have 1 USD value

0rpseqwe

Summary

The protocol tokenizes real estate using the RAACNFT.sol contract, which retrieves house prices from an oracle. When a user mints an NFT to represent a real-world asset, they must transfer an amount of tokens equivalent to the house price to the NFT contract. However, since prices are denominated in USD, assuming that stablecoins always have a value of one USD introduces a vulnerability—if the stablecoin depegs, the protocol can suffer losses.

Vulnerability Details

In RAACHousePrices.sol we can see that house prices are set in USD:

/**
* @notice Allows the owner to set the house price for a token
* @param _tokenId The ID of the RAAC token
====>* @param _amount The price to set for the house in USD
*
* Updates timestamp for each token individually
*/
function setHousePrice(
uint256 _tokenId,
uint256 _amount
) external onlyOracle {
tokenToHousePrice[_tokenId] = _amount;
lastUpdateTimestamp = block.timestamp;
emit PriceUpdated(_tokenId, _amount);
}

Later price is read in RAACNFT.sol and exact amount of stable coins are transferred for the NFT:

function mint(uint256 _tokenId, uint256 _amount) public override {
uint256 price = raac_hp.tokenToHousePrice(_tokenId);
if(price == 0) { revert RAACNFT__HousePrice(); }
if(price > _amount) { revert RAACNFT__InsufficientFundsMint(); }
​
// transfer erc20 from user to contract - requires pre-approval from user
token.safeTransferFrom(msg.sender, address(this), _amount);
​
// mint tokenId to user
_safeMint(msg.sender, _tokenId);
​
// If user approved more than necessary, refund the difference
if (_amount > price) {
uint256 refundAmount = _amount - price;
token.safeTransfer(msg.sender, refundAmount);
}
​
emit NFTMinted(msg.sender, _tokenId, price);
}

Impact

A depeg of 1% could mean that a house priced at 100,000 USD would be tokenized by paying 99,000 USD value, causing a loss of 1000 USD for the protocol.

Recommendations

Consider fetching the stable token price from oracles.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Protocol assumes 1 CRVUSD = 1 USD without using a price oracle, risking incorrect liquidations or other inacurate accounting if the stablecoin depegs

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Protocol assumes 1 CRVUSD = 1 USD without using a price oracle, risking incorrect liquidations or other inacurate accounting if the stablecoin depegs

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!