Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

RAACNFT wrongly suppose crvUSD to be equal to 1 dollar

0xalexsr

Summary

RAACNFT mint is done with crvUSD and house price is returned in USD thus expecting a crvUSD price of 1 USD which won't be the case during depeg.

Vulnerability Details

Looking on crvUSD price history on [coinmarketcap](https://coinmarketcap.com/currencies/crvusd/), we can see that it is rarely worth exactly 1 USD

US average home price is ~$400k. A 0.5% difference would represents a $2k difference

in RAACNFT::mint

function mint(uint256 _tokenId, uint256 _amount) public override {
uint256 price = raac_hp.tokenToHousePrice(_tokenId);
if(price == 0) { revert RAACNFT__HousePrice(); }
if(price > _amount) { revert RAACNFT__InsufficientFundsMint(); }
​
token.safeTransferFrom(msg.sender, address(this), _amount);
...
}

price is the amount to be paid in crvToken by the user.

The price is retrieved from raac_hp.tokenToHousePrice(tokenId)

in RAACHousePrices, tokenToHousePrice mapping is set via the setHousePrice function

/// @notice Mapping from RAAC tokenId to house price in USD
mapping(uint256 => uint256) public tokenToHousePrice;
​
function setHousePrice(
uint256 _tokenId,
uint256 _amount
) external onlyOracle {
tokenToHousePrice[_tokenId] = _amount;
lastUpdateTimestamp = block.timestamp;
emit PriceUpdated(_tokenId, _amount);
}

As mentionned in the comment, house price is in USD not in crvUSD.

The house price is set by the RAACHousePriceOracle which is likely to be in USD making the comment reliable.

At not point in the flow, the USD value is converted to crvUSD, thus the protocol expects a 1-1 exchange rate between USD and crvUSD.

Impact

Users won't pay the real USD value of the houses price but a crvUSD value which can sometimes be beneficial for the users and sometimes no.

The protocol makes the assumption that crvUSD-USD exchange rate is 1-1 and that it will always remain the same, during peak market volatility the exchange rate impact can be even higher especially considering the low marketcap of crvUSD being only around 74m.

The impact is high and the likelihood is high considering the price history where price is rarely 1-1 between crvUSD and USD

Recommendations

Add another oracle for the crvUSD-USD exchange rate and used the exchange rate in house price calculations for users to spend an amount in crvUSD.

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Protocol assumes 1 CRVUSD = 1 USD without using a price oracle, risking incorrect liquidations or other inacurate accounting if the stablecoin depegs

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Protocol assumes 1 CRVUSD = 1 USD without using a price oracle, risking incorrect liquidations or other inacurate accounting if the stablecoin depegs

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.