Core Contracts

Summary

The getNFTPrice function is intended to retrieve the NFT price from the oracle and ensure that the price data is fresh. However, while the comment indicates that it “checks if the price is stale,” the function only verifies that the price is non-zero. It does not check the lastUpdateTimestamp, potentially allowing outdated price data to be used.

Vulnerability Details

In file `contracts/core/pools/LendingPool/LendingPool.sol` function getNFTPrice it didn't check the pricce is stale or not as in the comments.

This indicates the following issues

• Missing Freshness Check:

The function retrieves both the price and lastUpdateTimestamp from the oracle. However, it only checks if the price is non-zero and does not evaluate the lastUpdateTimestamp to determine whether the price data is stale.

• Inconsistent Documentation:

The comment above the function claims that it performs a staleness check, which misleads developers and auditors regarding its actual behavior.

• Potential Oracle Data Issues:

Without validating the recency of the data, stale price information might be returned, which can compromise collateral evaluations and other dependent calculations.

Impact

• Incorrect Collateral Valuation:

Stale price data can lead to inaccurate assessments of an NFT’s value, potentially allowing borrowers to over-leverage their positions.

• Liquidation Errors:

Inaccurate collateral valuation may trigger unintended liquidations or prevent proper liquidations when necessary, destabilizing the lending protocol.

• Exploitation Risk:

Attackers could potentially manipulate the timing of oracle updates or exploit delays to benefit from outdated pricing, resulting in financial losses for the protocol and its users.

Tools Used

Manuel review

Recommendations

• Implement Timestamp Validation:

Update the getNFTPrice function to include a check on the lastUpdateTimestamp. For example, if the timestamp exceeds a predefined threshold (indicating stale data), the function should revert or return an error.

• Update Documentation:

Ensure that the comments accurately reflect the implemented logic, clearly stating that the staleness check is performed on the price data, and detail the conditions under which data is considered stale.

• Oracle Data Management:

Consider integrating a mechanism that guarantees data freshness from the oracle or provides fallback options if the data is outdated.