Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

`RAACHousePrices` Should Implement Individual `lastUpdateTimestamp` for each `tokenId`.

kupiasec

Summary

RAACHousePrices.setHousePrice() does not check if the price is stale. As a result, a stale price could be used, allowing borrowers to borrow more than they are permitted, which poses a potential risk of fund loss.

Vulnerability Details

The RAACHousePrices.setHousePrice() function is designed to set a specific tokenId's price, but it updates the global variable lastUpdateTimestamp. This approach is flawed. Consequently, if a specific tokenId's price is updated, other tokenIds also appear to have been updated recently. As a result, stale prices could be used for some tokenIds.

function setHousePrice(
uint256 _tokenId,
uint256 _amount
) external onlyOracle {
tokenToHousePrice[_tokenId] = _amount;
54 lastUpdateTimestamp = block.timestamp;
emit PriceUpdated(_tokenId, _amount);
}

Impact

Stale prices could be utilized.

Tools Used

Manual review

Recommendations

Implement individual lastUpdateTimestamp for each tokenId.

Updates

Lead Judging Commences

inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACHousePrices uses a single global lastUpdateTimestamp for all NFTs instead of per-token tracking, causing misleading price freshness data

inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACHousePrices uses a single global lastUpdateTimestamp for all NFTs instead of per-token tracking, causing misleading price freshness data

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!