Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

RAACNFT fails to tokenize real estate

aregen

Summary

One of the main goals of this protocol is to tokenize real estate. The project offers no way of doing this and instead requires the user to lock ERC20 token (stablecoin) having a value equivalent to that of their real estate.

Vulnerability Details

RAACNFT#mint allows a user to mint an NFT, however it requires that the user transfer stablecoin with a value equal to that of their real estate. This means that if the user e.g. has a house worth 200,000 USD, and they wish to tokenize it by minting an NFT through the RAACNFT contract, they need to have another 200,000 USD in liquid assets (ERC20 stablecoin) to lock in the RAACNFT contract. This means the user needs 400,000 USD worth of assets to mint an NFT that allegedly represents their house worth 200,000 USD.

function mint(uint256 _tokenId, uint256 _amount) public override {
uint256 price = raac_hp.tokenToHousePrice(_tokenId);
if(price == 0) { revert RAACNFT__HousePrice(); }
if(price > _amount) { revert RAACNFT__InsufficientFundsMint(); }
​
// transfer erc20 from user to contract - requires pre-approval from user
token.safeTransferFrom(msg.sender, address(this), _amount);
​
// mint tokenId to user
_safeMint(msg.sender, _tokenId);
​
// If user approved more than necessary, refund the difference
if (_amount > price) {
uint256 refundAmount = _amount - price;
token.safeTransfer(msg.sender, refundAmount);
}
​
emit NFTMinted(msg.sender, _tokenId, price);
}

Additionally, the contract doesn't offer any way of tying the NFT to real estate:

  • No verification of property ownership or legal rights

  • No mechanism to ensure the tokenId corresponds to a real property

  • No integration with real-world property registration systems

  • No mechanism to prevent multiple NFTs being minted for the same property

Impact

  • Users may purchase NFTs believing they represent actual property ownership when they don't

  • The misalignment between marketed functionality and actual implementation could damage project credibility

  • The system could allow multiple NFTs to be minted for the same property, leading to ownership disputes

Recommendations

  • Clearly document the relationship between NFTs and properties

  • Add property details to token metadata

  • Don't require users to lock stablecoin with value equaling that of their real estate

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!