Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Stale NFT price oracle data enables incorrect collateral valuation

dobrevaleri

Summary

The LendingPool::getNFTPrice() function retrieves NFT prices from the oracle without validating the timestamp of the last price update, allowing stale prices to be used for critical collateral calculations.

Vulnerability Details

The getNFTPrice() function retrieves the price and last update timestamp from the oracle but fails to validate if the price data is stale:

function getNFTPrice(uint256 tokenId) public view returns (uint256) {
(uint256 price, uint256 lastUpdateTimestamp) = priceOracle.getLatestPrice(tokenId);
if (price == 0) revert InvalidNFTPrice();
return price;
}

The function ignores the lastUpdateTimestamp value returned by the oracle. This means that even if the price data is days or weeks old, it will still be used for calculating collateral values and health factors.

Impact

Using stale price data can lead to incorrect collateral valuations used for borrowing limits

A stale high price could allow users to borrow more than their NFT is currently worth, while a stale low price could trigger unnecessary liquidations.

Recommendation

Add Maximum Price Age Check

function getNFTPrice(uint256 tokenId) public view returns (uint256) {
(uint256 price, uint256 lastUpdateTimestamp) = priceOracle.getLatestPrice(tokenId);
if (price == 0) revert InvalidNFTPrice();
+ if (block.timestamp - lastUpdateTimestamp > MAX_PRICE_AGE) revert StalePrice();
return price;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::getNFTPrice or getPrimeRate doesn't validate timestamp staleness despite claiming to, allowing users to exploit outdated collateral values during price drops

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::getNFTPrice or getPrimeRate doesn't validate timestamp staleness despite claiming to, allowing users to exploit outdated collateral values during price drops

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!