Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Stale NFT Price Risk in `LendingPool::getNFTPrice`

whitekittyhacker

Summary

The LendingPool::getNFTPrice function retrieves the price of an NFT from an oracle but does not verify whether the price is stale. If the oracle's lastUpdateTimestamp is outdated, the function may return an old price, leading to incorrect valuations and potential exploitation in lending operations.

Vulnerability Details

https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/pools/LendingPool/LendingPool.sol#L591-L595
The function fetches the latest price and its last update timestamp. However, it does not check whether lastUpdateTimestamp is sufficiently recent. This means that if the oracle stops updating or experiences delays, the returned price may be outdated. A borrower could use an old, inflated price to receive more collateral than they should, or a liquidator might rely on outdated pricing, leading to unfair liquidations.

Impact

Users could manipulate lending terms based on stale prices.

Tools Used

Manual review

Recommendations

Introduce a freshness check by comparing lastUpdateTimestamp against block.timestamp with an acceptable time threshold (PRICE_STALE_THRESHOLD):

uint256 public constant PRICE_STALE_THRESHOLD = 1 hours; // Define a reasonable threshold
​
function getNFTPrice(uint256 tokenId) public view returns (uint256) {
(uint256 price, uint256 lastUpdateTimestamp) = priceOracle.getLatestPrice(tokenId);
​
if (price == 0) revert InvalidNFTPrice();
if (block.timestamp - lastUpdateTimestamp > PRICE_STALE_THRESHOLD) revert StaleNFTPrice();
​
return price;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::getNFTPrice or getPrimeRate doesn't validate timestamp staleness despite claiming to, allowing users to exploit outdated collateral values during price drops

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::getNFTPrice or getPrimeRate doesn't validate timestamp staleness despite claiming to, allowing users to exploit outdated collateral values during price drops

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.