Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Incorrect Oracle Utility Documentation Leading to Functionality DOS

hailthelord

Summary

The documentation states:

Oracle: Changes the house price in RAACHousePrice and updates the prime rate in LendingPool.

This suggests that RAACHousePrice should update both the house price and the prime rate in LendingPool. However, the implementation does not support this functionality due to missing external function calls.

Vulnerability Details

The function responsible for setting the prime rate is:

function setPrimeRate(uint256 newPrimeRate) external onlyPrimeRateOracle {
ReserveLibrary.setPrimeRate(reserve, rateData, newPrimeRate);
}

The modifier onlyPrimeRateOracle suggests that RAACPriceRateOracle is expected to call this function.

Within RAACPriceRateOracle, the function is invoked in an internal function:

function _processResponse(bytes memory response) internal override {
lastPrimeRate = abi.decode(response, (uint256));
lastUpdateTimestamp = block.timestamp;
lendingPool.setPrimeRate(lastPrimeRate);
emit PrimeRateUpdated(lastPrimeRate);
}

This function is triggered by another internal function inside BaseChainLinkFunctionsOracle :

function fulfillRequest(
bytes32 requestId,
bytes memory response,
bytes memory err
) internal override {
s_lastResponse = response;
s_lastError = err;
​
if (err.length == 0) {
if (response.length == 0) {
revert FulfillmentFailed();
}
_processResponse(response);
}
}

Since fulfillRequest is an internal function and is not overridden in its child contract RAACPriceRateOracle, the expected functionality is currently not possible.

POC

function setPrimeRate(uint256 newPrimeRate) external onlyPrimeRateOracle {
ReserveLibrary.setPrimeRate(reserve, rateData, newPrimeRate);
}

Impact

  • Denial of Service: The oracle cannot update the prime rate in LendingPool.

  • Inconsistent Documentation: The feature is documented but does not exist in implementation.

  • Potential Misconfigurations: Developers may assume the oracle updates the prime rate when it does not.

Tools Used

Manual Review

Recommendations

  • Expose _processResponse() or fulfillRequest() externally or through a public function.

  • If this feature is intentionally omitted, update the documentation to reflect the correct functionality.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!