Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

No Range Check for lastPrimeRate in RAACPrimeRateOracle

bryanconquer

Summary

The RAACPrimeRateOracle contract does not validate the lastPrimeRate value before updating it. This lack of validation allows for malicious or incorrect oracle responses, which could disrupt the Lending Pool by setting an invalid prime rate.

Vulnerability Details

function _processResponse(bytes memory response) internal override {
lastPrimeRate = abi.decode(response, (uint256));
lastUpdateTimestamp = block.timestamp;
lendingPool.setPrimeRate(lastPrimeRate);
emit PrimeRateUpdated(lastPrimeRate);
}
​

The function directly decodes and updates lastPrimeRate without validating its value.

  • If the oracle sends a malicious response (e.g., 0 or an extremely large number), the Lending Pool will incorrectly adjust its rates.

  • Impact: This could lead to incorrect lending interest rates, unfair borrowing conditions, or even a denial of service if extreme values disrupt operations.



    Impact

The absence of range validation for lastPrimeRate can lead to severe disruptions in the lending ecosystem, exposing the Lending Pool to significant risks.

Tools Used

manual review

Recommendations
Add a range validation for lastPrimeRate before updating it.

function _processResponse(bytes memory response) internal override {
uint256 newPrimeRate = abi.decode(response, (uint256));
​
// Ensure the value is within an acceptable range (e.g., 1% to 100%)
require(newPrimeRate >= 1e16 && newPrimeRate <= 1e18, "Invalid prime rate");
​
lastPrimeRate = newPrimeRate;
lastUpdateTimestamp = block.timestamp;
lendingPool.setPrimeRate(lastPrimeRate);
emit PrimeRateUpdated(lastPrimeRate);
}
​
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.