Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Use of Potentially Stale NFT Prices from Oracle Without Timestamp Validation (Freshness check)

agbanusijohn

Summary

The getNFTPrice function retrieves NFT pricing data from an oracle but does not enforce any checks against the timestamp, thereby risking the use of stale price data in collateral evaluations.

Vulnerability Details

IN https://github.com/Cyfrin/2025-02-raac/blob/main/contracts/core/pools/LendingPool/LendingPool.sol#L591

The function extracts both the price and the lastUpdateTimestamp:

​
(uint256 price, uint256 lastUpdateTimestamp) = priceOracle.getLatestPrice(tokenId);

However, the subsequent logic only verifies that price != 0, completely ignoring the lastUpdateTimestamp. Without validating the freshness of the price data, the protocol may inadvertently use outdated valuations for collateral, causing either underestimation or overestimation of user collateral, affecting borrowing capacity

Impact

  • Collateral Misvaluation: Stale NFT prices could lead to either underestimation or overestimation of user collateral, affecting borrowing capacity.

Tools Used

Manual Review

Recommendations

Incorporate a freshness check against lastUpdateTimestamp to ensure that the price data is recent

Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::getNFTPrice or getPrimeRate doesn't validate timestamp staleness despite claiming to, allowing users to exploit outdated collateral values during price drops

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::getNFTPrice or getPrimeRate doesn't validate timestamp staleness despite claiming to, allowing users to exploit outdated collateral values during price drops

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.