Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Privileged Owner Role Can Maliciously Swap Oracles

petesol

Summary

The contract RAACHousePriceOracle.sol allows the deployer or owner to arbitrarily change the price oracle used in the lending system. This can allow an attacker with owner privileges to manipulate the house price to liquidate users unfairly or enable under-collateralized borrowing.

Vulnerability Details

  • The function setOracle(address _oracle) in RAACHousePrices.sol allows the owner to change the oracle at any time.

  • An attacker with access to the owner role can swap the real oracle with a fake one that reports manipulated house prices.

  • Since the RAACHousePriceOracle determines the collateral value of an NFT-backed loan, altering the price oracle enables an attacker to artificially inflate or deflate collateral value.

  • This can result in unfair liquidations or arbitrage attacks.

PoC for Arbitrary Oracle Swap

Exploit Scenario

  • An attacker with owner privileges swaps the real price oracle with a fake one.

  • The fake oracle artificially inflates house prices, allowing under-collateralized loans.

  • The attacker borrows excess CRVUSD and dumps it, draining the liquidity pool.

PoC Exploit

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;
​
import "../contracts/oracles/RAACHousePrices.sol";
​
contract MaliciousOracle {
function getHousePrice(uint256 tokenId) external pure returns (uint256) {
return 10**18 * 1000000; // Fake price: 1M USDC per NFT
}
}
​
contract OracleSwapExploit {
RAACHousePrices public target;
MaliciousOracle public fakeOracle;
​
constructor(address _target) {
target = RAACHousePrices(_target);
fakeOracle = new MaliciousOracle();
}
​
function attack() external {
target.setOracle(address(fakeOracle)); // Owner swaps to fake oracle
}
}

Expected Outcome

  • Price manipulation enables exploiters to borrow excessive CRVUSD.

  • Borrowers can escape liquidation unfairly.

  • The lending pool suffers from bad debt accumulation.

Impact

  • If the oracle is swapped to one that reports inflated house prices, borrowers can take out excessive loans and dump the borrowed assets.

  • If the oracle reports deflated prices, lenders can liquidate borrowers unfairly and acquire valuable NFTs at a discount.

Tools Used

  • Manual Review of RAACHousePrices.sol

  • Slither for function privilege analysis

Recommendations

  • Implement a governance mechanism for oracle changes instead of allowing arbitrary owner control.

  • Introduce a timelock to prevent instant oracle swapping.

  • Use Chainlink decentralized oracles to ensure price data integrity.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!