Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Wrong price for house could be sent if responses are not recieved in order from Oracle

greese

Summary

RAACHousePriceOracle sends a request to the DON when it wishes to receive that latest price of a house from the Oracle. The house id is set in _beforeFulfill to keep track of which house price will be sent on the next response received. An issue arises because there is no guarantee the next response received will be for that house id.

Vulnerability Details

A request is made to the DON for the price of a house. The house id is passed in as calldata which is set in _beforeFulfill and will be set on the next response through _processResponse.

/**
* @notice Hook called before fulfillment to store the house ID
* @param args The arguments passed to sendRequest
*/
function _beforeFulfill(string[] calldata args) internal override {
lastHouseId = args[0].stringToUint();
}
​
/**
* @notice Process the response from the oracle
* @param response The response from the oracle
*/
function _processResponse(bytes memory response) internal override {
uint256 price = abi.decode(response, (uint256));
housePrices.setHousePrice(lastHouseId, price);
emit HousePriceUpdated(lastHouseId, price);
}

The problem is that there is no guarantee the next response will include the response for the corresponding house ID set. Take the following example:

  1. Request A is sent for House ID 1 with sendRequest()

  2. _beforeFulfill() sets lastHouseId = 1

  3. Request B is sent for House ID 2

  4. _beforeFulfill() sets lastHouseId = 2

  5. Response for Request A arrives first

  6. _processResponse() uses lastHouseId (which is now 2) to set the price

  7. The price from Request A (meant for House 1) gets incorrectly set for House 2

Impact

Incorrect price is set for the houses

Tools Used

Manual Review

Recommendations

Pass the house id along with the price in the response

Updates

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Oracle Race Condition in RAACHousePriceOracle causes price misassignment between NFTs

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Oracle Race Condition in RAACHousePriceOracle causes price misassignment between NFTs

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.