Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Protocol assumes stable coin to always have 1 USD value

0rpseqwe

Summary

The protocol tokenizes real estate using the RAACNFT.sol contract, which retrieves house prices from an oracle. When a user mints an NFT to represent a real-world asset, they must transfer an amount of tokens equivalent to the house price to the NFT contract. However, since prices are denominated in USD, assuming that stablecoins always have a value of one USD introduces a vulnerability—if the stablecoin depegs, the protocol can suffer losses.

Vulnerability Details

In RAACHousePrices.sol we can see that house prices are set in USD:

/**
* @notice Allows the owner to set the house price for a token
* @param _tokenId The ID of the RAAC token
====>* @param _amount The price to set for the house in USD
*
* Updates timestamp for each token individually
*/
function setHousePrice(
uint256 _tokenId,
uint256 _amount
) external onlyOracle {
tokenToHousePrice[_tokenId] = _amount;
lastUpdateTimestamp = block.timestamp;
emit PriceUpdated(_tokenId, _amount);
}

Later price is read in RAACNFT.sol and exact amount of stable coins are transferred for the NFT:

function mint(uint256 _tokenId, uint256 _amount) public override {
uint256 price = raac_hp.tokenToHousePrice(_tokenId);
if(price == 0) { revert RAACNFT__HousePrice(); }
if(price > _amount) { revert RAACNFT__InsufficientFundsMint(); }
​
// transfer erc20 from user to contract - requires pre-approval from user
token.safeTransferFrom(msg.sender, address(this), _amount);
​
// mint tokenId to user
_safeMint(msg.sender, _tokenId);
​
// If user approved more than necessary, refund the difference
if (_amount > price) {
uint256 refundAmount = _amount - price;
token.safeTransfer(msg.sender, refundAmount);
}
​
emit NFTMinted(msg.sender, _tokenId, price);
}

Impact

A depeg of 1% could mean that a house priced at 100,000 USD would be tokenized by paying 99,000 USD value, causing a loss of 1000 USD for the protocol.

Recommendations

Consider fetching the stable token price from oracles.

Updates

Lead Judging Commences

inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Protocol assumes 1 CRVUSD = 1 USD without using a price oracle, risking incorrect liquidations or other inacurate accounting if the stablecoin depegs

inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Protocol assumes 1 CRVUSD = 1 USD without using a price oracle, risking incorrect liquidations or other inacurate accounting if the stablecoin depegs

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!