Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Lack of `requestID` validation

pontifex

Summary

The RAACHousePriceOracle._processResponse sets a received price for the lastHouseId house. The problem is the received price can be for the previous house. This can happen when the new request is invoked before the response from the previous request has been received.

Vulnerability Details

The _beforeFulfill function stores the lastHouseId every time the BaseChainlinkFunctionsOracle.sendRequest is invoked.

function _beforeFulfill(string[] calldata args) internal override {
lastHouseId = args[0].stringToUint();
}

The oracle response is not a part of the sendRequest transaction. So the response can happen even in several blocks after. So a new sendRequest can rewrite the lastHouseId storage value before the previous request has been received. In this case the pending response will be applied for the new lastHouseId.

function _processResponse(bytes memory response) internal override {
uint256 price = abi.decode(response, (uint256));
>> housePrices.setHousePrice(lastHouseId, price);
emit HousePriceUpdated(lastHouseId, price);
}

Though the BaseChainlinkFunctionsOracle.sendRequest stores the s_lastRequestId variable there is no check if s_lastRequestId == requestId. This makes it possible to apply an incorrect price for a house.
BaseChainlinkFunctionsOracle.sol:

function fulfillRequest(
>> bytes32 requestId,
bytes memory response,
bytes memory err
) internal override {
s_lastResponse = response;
s_lastError = err;
​
if (err.length == 0) {
if (response.length == 0) {
revert FulfillmentFailed();
}
_processResponse(response);
}
}

Impact

This issue can cause asset losses due to wrong house prices.

Tools used

Manual Review

Recommendations

There is no good mitigation in the area of the RAACHousePriceOracle. The only simple solution is checking if s_lastRequestId == requestId in the fulfillRequest function.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Oracle Race Condition in RAACHousePriceOracle causes price misassignment between NFTs

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Oracle Race Condition in RAACHousePriceOracle causes price misassignment between NFTs

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!