Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Missing Oracle Price Staleness Check

ibukunola

Summary

The getNFTPrice() function retrieves NFT prices without checking the lastUpdateTimestamp for staleness, risking over-borrowing against outdated valuations. This medium-impact, medium-likelihood vulnerability could undercollateralize the protocol if NFT prices drop, leading to unrecoverable losses during liquidation.

Vulnerability Details

The getNFTPrice() function calls priceOracle.getLatestPrice() but doesn’t ensure the price is recent. Example:

Oracle stalls, reporting 1000 crvUSD (1000e18 WAD) while the real value falls to 100 crvUSD.
Borrower deposits 1 NFT, borrows 800 crvUSD (80% of stale value).
NFT drops to 100e18; liquidation recovers only 100 crvUSD, leaving a 700 crvUSD shortfall.
Stale prices inflate getUserCollateralValue(), exposing the protocol to risk.

Impact

The protocol could lose significant value (e.g., 700 crvUSD per incident) due to undercollateralized loans, a medium-impact outcome. The medium likelihood reflects the realistic chance of oracle delays or failures, especially in volatile NFT markets, threatening financial stability.

Tools Used

Testing Frameworks: Hardhat to simulate stale prices and over-borrowing scenarios.

Recommendations

Add a staleness check in getNFTPrice():

function getNFTPrice(uint256 tokenId) public view returns (uint256) {
(uint256 price, uint256 lastUpdateTimestamp) = priceOracle.getLatestPrice(tokenId);
require(price > 0, "Invalid NFT price");
require(block.timestamp - lastUpdateTimestamp < 1 hours, "Price too stale");
return price;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::getNFTPrice or getPrimeRate doesn't validate timestamp staleness despite claiming to, allowing users to exploit outdated collateral values during price drops

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::getNFTPrice or getPrimeRate doesn't validate timestamp staleness despite claiming to, allowing users to exploit outdated collateral values during price drops

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.