Core Contracts

Summary

The contract RAACHousePrices maintains a global lastUpdateTimestamp, which does not track price updates on a per-token basis. The function getLatestPrice returns this global timestamp, leading to inaccurate price update tracking for individual tokens. Although a view function, it will have a severe impact as it is heavily relied on for offchain(frontend) data feed for the real world assets.

Vulnerability Details

The function getLatestPrice states in its documentation that it "returns a token-specific update timestamp," but instead, it returns the global lastUpdateTimestamp. This creates an inconsistency where:

1. If multiple token prices are updated at different times, the timestamp reflects only the latest update, not the individual token’s update.

2. Calling getLatestPrice for different tokens may return misleading timestamps.

Affected Code:

Impact

• Misleading timestamps may cause external consumers (such as dApps or off-chain services) to assume a token’s price is more recent than it actually is.

• Users may make financial decisions based on incorrect price update timestamps.

• Potential oracle exploits if timestamps are relied upon for price validity.

Tools Used

Manual review.

Recommendations

To ensure each token price update has an accurate timestamp, store timestamps per token:

This ensures that each token correctly tracks its own last update timestamp.