Core Contracts

Summary
The RAACHousePriceOracle contract lacks proper validation of lastHouseId before updating house prices in RAACHousePrices. The house ID (lastHouseId) is set in _beforeFulfill(), but there is no guarantee that _beforeFulfill() is always called before _processResponse(). As a result:

• A wrong houseId could receive a price update that was not meant for it.

• If _beforeFulfill() is skipped or reverts, lastHouseId may remain outdated or uninitialized, leading to incorrect price updates.

Vulnerability Details

Impact

Incorrect Price Updates for Houses

• If lastHouseId is incorrect, the contract could update the wrong house’s price, causing data inconsistencies.

• Example:

  • The oracle fetches House ID 1001’s price update.

  • Due to a bug, House ID 5002 receives the price instead.

  • This results in wrong pricing data affecting lending, insurance, and financial applications.

Tools Used

manual review

Recommendations
Validate lastHouseId before updating prices

Ensure _beforeFulfill() executes before _processResponse()