Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Lack of staleness price check in RAACHousePrices.sol

demonhat

Summary

The RAACHousePrices.sol contract lacks a staleness check mechanism for price updates, allowing outdated price data to be considered valid indefinitely. This would lead to significant economic damage as the system continues to use potentially severely outdated price information for critical financial operations.

Vulnerability Details

The vulnerability exists in two key functions:

// In RAACHousePrices.sol
function setHousePrice(uint256 tokenId, uint256 price) external {
// Sets price but doesn't enforce update frequency
}
​
function getLatestPrice(uint256 tokenId) external view returns (uint256, uint256) {
// Returns price without checking staleness
}

Proof of code:

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.19;
​
import "forge-std/Test.sol";
import "../../../../contracts/core/primitives/RAACHousePrices.sol";
​
contract RAACHousePricesTest is Test {
RAACHousePrices public housePrices;
address owner = address(1);
address oracle = address(2);
address attacker = address(3);
address user = address(4);
​
event PriceUpdated(uint256 tokenId, uint256 newPrice);
​
function setUp() public {
// Deploy with owner
housePrices = new RAACHousePrices(owner);
// Set oracle
vm.prank(owner);
housePrices.setOracle(oracle);
}
​
// POC 1: Stale Price Vulnerability
function testStalePriceVulnerability() public {
uint256 tokenId = 1;
uint256 price = 100 ether;
​
// Oracle sets initial price
vm.prank(oracle);
housePrices.setHousePrice(tokenId, price);
​
// Fast forward 1 year
vm.warp(block.timestamp + 365 days);
​
// User can still get price without any staleness check
(uint256 returnedPrice, uint256 lastUpdate) = housePrices.getLatestPrice(tokenId);
// Price is still considered valid even though extremely old
assertEq(returnedPrice, price);
assertLt(lastUpdate, block.timestamp - 364 days);
// In a real scenario, this could lead to:
// 1. Users getting loans with outdated collateral values
// 2. Incorrect liquidations
// 3. Mispriced asset purchases/sales
}
}

The test demonstrates that:

// Oracle sets initial price
vm.prank(oracle);
housePrices.setHousePrice(tokenId, price);
​
// Fast forward 1 year
vm.warp(block.timestamp + 365 days);
​
// Price still considered valid after a year
(uint256 returnedPrice, uint256 lastUpdate) = housePrices.getLatestPrice(tokenId);
assertEq(returnedPrice, price);

Impact

The lack of staleness checks can lead to:

  • Incorrect collateral valuations in lending

  • Mispriced liquidations

  • Unfair asset trades

  • System-wide economic imbalances

  • Potential for market manipulation

Tools Used

Recommendations

Add a stale price check

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::getNFTPrice or getPrimeRate doesn't validate timestamp staleness despite claiming to, allowing users to exploit outdated collateral values during price drops

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::getNFTPrice or getPrimeRate doesn't validate timestamp staleness despite claiming to, allowing users to exploit outdated collateral values during price drops

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.