Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View all submissions
Previous Next
Submission Details
Severity: high
Invalid

Missing Rate Validation and Access Controls in RAACPrimeRateOracle::_processResponse Enable Oracle Price Manipulation

Author Revealed upon completion

Summary

The RAACPrimeRateOracle::_processResponse function lacks crucial validation checks and rate limiting mechanisms when processing oracle responses, allowing manipulation of the protocol's prime rate which directly impacts lending and borrowing calculations.

Vulnerability Details

function _processResponse(bytes memory response) internal override {
lastPrimeRate = abi.decode(response, (uint256));
lastUpdateTimestamp = block.timestamp;
lendingPool.setPrimeRate(lastPrimeRate);
emit PrimeRateUpdated(lastPrimeRate);
}

The implementation has critical flaws:

  1. No bounds checking on prime rate values

  2. Direct lending pool updates without validation

  3. Missing rate change limits

  4. Lack of update frequency controls

  5. No governance approval requirements for significant changes

PoC

it("should allow extreme prime rate manipulation", async function() {
const maxPossibleRate = ethers.parseUnits("1000000", 27);
await mockOracle.connect(oracleOperator).mockResponse(
functionId,
requestId,
ethers.AbiCoder.defaultAbiCoder().encode(["uint256"], [maxPossibleRate])
);
const newPrimeRate = await lendingPool.getPrimeRate();
expect(newPrimeRate).to.equal(maxPossibleRate);
const userDebt = await lendingPool.getUserDebt(borrower.address);
const newInterest = await lendingPool.calculateInterest(userDebt);
expect(newInterest).to.be.gt(userDebt.mul(1000));
});

Impact

  • Instant mass liquidations through extreme rates

  • Borrowing cost manipulation

  • Protocol instability through rate volatility

  • Economic attacks through rate arbitrage

  • Potential system-wide DoS

Tools Used

  • Manual code review

  • Hardhat testing

  • Formal verification tools

Recommendations

  1. Implement min/max bounds for prime rates

  2. Add rate change limits between updates

  3. Enforce minimum time delays between updates

  4. Require governance approval for large changes

  5. Add circuit breaker for extreme rates

function _processResponse(bytes memory response) internal override {
uint256 newRate = abi.decode(response, (uint256));
require(newRate >= MIN_PRIME_RATE && newRate <= MAX_PRIME_RATE, "Rate out of bounds");
require(block.timestamp >= lastUpdateTimestamp + MIN_UPDATE_DELAY, "Update too soon");
require(
_isRateChangeWithinLimit(lastPrimeRate, newRate),
"Rate change too large"
);
if(_requiresGovernanceApproval(lastPrimeRate, newRate)) {
_queueRateChange(newRate);
} else {
_updateRate(newRate);
}
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 10 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.