Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Missing Slippage Protection in `RAACNFT.mint()`

0xshoonya

Summary

The mint() function in RAACNFT contract lacks slippage protection when minting NFTs based on house prices. The price is fetched from an oracle but there's no mechanism to ensure the price hasn't changed unfavorably between the time a user initiates the transaction and when it's executed.

Vulnerability Details

The core issue lies in how the mint() function handles price validation:

function mint(uint256 _tokenId, uint256 _amount) public override {
uint256 price = raac_hp.tokenToHousePrice(_tokenId);
if(price == 0) { revert RAACNFT__HousePrice(); }
if(price > _amount) { revert RAACNFT__InsufficientFundsMint(); }
​
// transfer erc20 from user to contract
token.safeTransferFrom(msg.sender, address(this), _amount);
_safeMint(msg.sender, _tokenId);
​
// Refund excess
if (_amount > price) {
uint256 refundAmount = _amount - price;
token.safeTransfer(msg.sender, refundAmount);
}
emit NFTMinted(msg.sender, _tokenId, price);
}

Users specify _amount they're willing to pay. The function only checks if _amount is sufficient (price > _amount) but there's no upper bound check on the price

The lack of slippage protection means users have no way to specify their maximum acceptable price, forcing them to either:

  1. Risk transaction failure by sending exact amounts

  2. Over-collateralize their transactions significantly

  3. Accept any price as long as it's below their sent amount

This is particularly problematic because house prices can be volatile and oracle updates can be frequent, making it difficult for users to predict the actual execution price of their mint transaction.

Impact

Users lose value through unfavorable price executions

Tools Used

Manual Review

Recommendations

function mint(
uint256 _tokenId,
uint256 _amount,
+ uint256 _maxPrice // Add maximum acceptable price
) public {
uint256 price = raac_hp.tokenToHousePrice(_tokenId);
+ // Add slippage check
+ if(price > _maxPrice) {
+ revert RAACNFT__PriceExceedsMaximum();
+ }
if(price > _amount) {
revert RAACNFT__InsufficientFundsMint();
}
// ... rest of the function
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!