Submission Details
Severity:
Stale Prices from oracle could be returned
Summary
Currently there is a call to `getNFTPrice` which is supposed to get the price of the NFT, the implementation of the function is as below
```javascript
function getNFTPrice(uint256 tokenId) public view returns (uint256) {
(uint256 price, uint256 lastUpdateTimestamp) = priceOracle.getLatestPrice(tokenId);
if (price == 0) revert InvalidNFTPrice();
return price;
}
```
As we can see we have a lastUpdateTimeStamp which should show the last time the price was updated. However, there is no check to confirm that the price is recent, meaning an older price could be returned. If oracle stops updating prices then users might continue interacting with older prices.
To prevent stale prices, consider adding a check for how recent the price update is
# POC
* Suppose the priceOracle was last updated 12 hours ago
* but a significant price fluctuation has since occurred.
* The oracle is not updating anymore
A borrower may unknowingly take a loan based on an outdated price, leading to unfair liquidations or manipulation risks.
https://github.com/Cyfrin/2025-02-raac/blob/main/contracts/core/pools/LendingPool/LendingPool.sol#L592
Impact
Stale Prices Returned
Tools Used
manual Review
Recommendations
```javascript
function getNFTPrice(uint256 tokenId) public view returns (uint256) {
(uint256 price, uint256 lastUpdateTimestamp) = priceOracle.getLatestPrice(tokenId);
if (price == 0) revert InvalidNFTPrice();
if (block.timestamp - lastUpdateTimestamp > MAX_PRICE_AGE) revert StalePrice();
return price;
}
```
Updates
Lead Judging Commences
inallhonesty 3 months ago
Submission Judgement Published Assigned finding tags:
LendingPool::getNFTPrice or getPrimeRate doesn't validate timestamp staleness despite claiming to, allowing users to exploit outdated collateral values during price drops
inallhonesty 3 months ago
Submission Judgement Published Assigned finding tags:
LendingPool::getNFTPrice or getPrimeRate doesn't validate timestamp staleness despite claiming to, allowing users to exploit outdated collateral values during price drops
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.