Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

`RAACHousePrices` Should Implement Individual `lastUpdateTimestamp` for each `tokenId`.

kupiasec

Summary

RAACHousePrices.setHousePrice() does not check if the price is stale. As a result, a stale price could be used, allowing borrowers to borrow more than they are permitted, which poses a potential risk of fund loss.

Vulnerability Details

The RAACHousePrices.setHousePrice() function is designed to set a specific tokenId's price, but it updates the global variable lastUpdateTimestamp. This approach is flawed. Consequently, if a specific tokenId's price is updated, other tokenIds also appear to have been updated recently. As a result, stale prices could be used for some tokenIds.

function setHousePrice(
uint256 _tokenId,
uint256 _amount
) external onlyOracle {
tokenToHousePrice[_tokenId] = _amount;
54 lastUpdateTimestamp = block.timestamp;
emit PriceUpdated(_tokenId, _amount);
}

Impact

Stale prices could be utilized.

Tools Used

Manual review

Recommendations

Implement individual lastUpdateTimestamp for each tokenId.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACHousePrices uses a single global lastUpdateTimestamp for all NFTs instead of per-token tracking, causing misleading price freshness data

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACHousePrices uses a single global lastUpdateTimestamp for all NFTs instead of per-token tracking, causing misleading price freshness data

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!