Submission Details
Severity:
Incorrect price when mint RAACNFT
Summary
When minting a new RAACNFT, the amount of stable token (USDC) is compared with USD. This comparison can lead to incorrect pricing if the stablecoin depegs.
Vulnerability Details
When mint token the specific token price is fetched from racc_hp.
/**
* @notice Allows the owner to set the house price for a token
* @param _tokenId The ID of the RAAC token
* @param _amount The price to set for the house in USD
*
* Updates timestamp for each token individually
*/
function setHousePrice(
uint256 _tokenId,
uint256 _amount
) external onlyOracle {
tokenToHousePrice[_tokenId] = _amount;
lastUpdateTimestamp = block.timestamp;
emit PriceUpdated(_tokenId, _amount);
}
From the comment we can see the return vaule is in USD.
And from mint function:
function mint(uint256 _tokenId, uint256 _amount) public override {
uint256 price = raac_hp.tokenToHousePrice(_tokenId);
if(price == 0) { revert RAACNFT__HousePrice(); }
if(price > _amount) { revert RAACNFT__InsufficientFundsMint(); }//@audit compare token(USDT) to USD.
// transfer erc20 from user to contract - requires pre-approval from user
token.safeTransferFrom(msg.sender, address(this), _amount);
// mint tokenId to user
_safeMint(msg.sender, _tokenId);
The amount is in stable token eg:USDC.
if the stablecoin depegs above comparation can lead to price error , minter use less or more assets than expected.
Impact
price error when stablecoin depegs
Tools Used
Eye
Recommendations
should convet stablecoin to USD before compare those two amount
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.