Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Stale NFT Price Oracle Data Allows Manipulation of Collateral Value

vasquez

Summary

The LendingPool::getNFTPrice function retrieves NFT prices from the oracle but fails to validate the lastUpdateTimestamp returned by the oracle. This allows stale price data to be used when calculating user collateral value, which is critical for determining borrowing capacity and liquidation conditions.

The issue affects multiple key functions that rely on NFT price data:

  • calculateHealthFactor

  • getUserCollateralValue

  • borrow

  • withdrawNFT

Impact

An attacker could exploit this by:

  1. Waiting for favorable stale prices that overvalue their NFT collateral

  2. Using the inflated collateral value to borrow more than they should be allowed

  3. Defaulting on the loan, leaving the protocol with bad debt

Recommendations

Add a maximum staleness check for oracle prices:

function getNFTPrice(uint256 tokenId) public view returns (uint256) {
(uint256 price, uint256 lastUpdateTimestamp) = priceOracle.getLatestPrice(tokenId);
if (price == 0) revert InvalidNFTPrice();
+ if (block.timestamp - lastUpdateTimestamp > MAX_PRICE_AGE) {
+ revert StalePrice();
+ }
return price;
}

Consider also:

  1. Adding a configurable MAX_PRICE_AGE parameter

  2. Implementing a grace period for price updates before blocking operations

  3. Adding emergency pause functionality if oracle fails to update prices

Updates

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::getNFTPrice or getPrimeRate doesn't validate timestamp staleness despite claiming to, allowing users to exploit outdated collateral values during price drops

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::getNFTPrice or getPrimeRate doesn't validate timestamp staleness despite claiming to, allowing users to exploit outdated collateral values during price drops

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.