Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Stale price issue in `getNFTPrice()`

0xblockhound

Summary

The getNFTPrice() function in the LendingPool contract fetches the current price of an NFT from the oracle. However, it does not check whether the retrieved price is stale. This can allow an attacker to exploit outdated prices while borrowing or repaying.

Vulnerability Details

The getNFTPrice() retrieves the latest price of an NFT using priceOracle.getLatestPrice(). It also fetches the lastUpdateTimestamp, but it only reverts when the price is 0, without validating if the price is fresh.

https://github.com/Cyfrin/2025-02-raac/blob/main/contracts/core/pools/LendingPool/LendingPool.sol#L591-L595

function getNFTPrice(uint256 tokenId) public view returns (uint256) {
(uint256 price, uint256 lastUpdateTimestamp) = priceOracle.getLatestPrice(tokenId);
if (price == 0) revert InvalidNFTPrice();
return price;
}

If the oracle fails to update prices for a long time, an attacker could exploit outdated values to manipulate borrowing and repayment transactions. For example:

Impact

If the price is too high, an attacker could borrow more than they should be allowed to.

Tools Used

Recommendations

Implement a stale price check like If lastUpdateTimestamp is older than a predefined period (e.g., 1 hour), the function should revert to prevent outdated price usage.

Updates

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::getNFTPrice or getPrimeRate doesn't validate timestamp staleness despite claiming to, allowing users to exploit outdated collateral values during price drops

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::getNFTPrice or getPrimeRate doesn't validate timestamp staleness despite claiming to, allowing users to exploit outdated collateral values during price drops

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.