Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View all submissions
Previous Next
Submission Details
Severity: high
Valid

Hardcoded Exchange Rate (getExchangeRate)

Author Revealed upon completion

Summary

The getExchangeRate function in the contract uses a hardcoded exchange rate instead of dynamically fetching the rate from a reliable on-chain oracle. This introduces a significant risk as the exchange rate may become outdated or inaccurate over time, leading to incorrect asset valuations and potential exploitation.

Vulnerability Details

function getExchangeRate() public pure returns (uint256) {
return 1000; // Hardcoded rate of 1 token = 1000 units
}

Root Cause

The function returns a static value that does not account for market fluctuations, liquidity changes, or external pricing sources. This can lead to:

Overvaluation or undervaluation of assets.

Arbitrage exploits where users swap assets at outdated rates.

Economic instability in the protocol.

Attack Scenario

Market Rate Divergence: The actual market rate for the token changes to 800 units per token.

Exploitation: Attackers use the outdated hardcoded rate (1000) to exchange tokens at an inflated value.

Financial Loss: The protocol suffers losses as attackers gain a better deal than the actual market rate.

Impact

Incorrect asset valuation, leading to financial losses for users and the protocol.

Exploitable arbitrage opportunities, where attackers profit from outdated rates.

Loss of protocol credibility, as inaccurate pricing affects user trust and adoption.

Tools Used

Recommendations

Use an On-Chain Oracle

Replace the hardcoded value with a real-time price feed from a trusted oracle like Chainlink:

import "@chainlink/contracts/src/v0.8/interfaces/AggregatorV3Interface.sol";
​
contract ExchangeRate {
AggregatorV3Interface internal priceFeed;
constructor() {
priceFeed = AggregatorV3Interface(0xYourOracleAddress);
}
​
function getExchangeRate() public view returns (uint256) {
(,int256 price,,,) = priceFeed.latestRoundData();
require(price > 0, "Invalid price data");
return uint256(price);
}
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 8 days ago
Submission Judgement Published
Validated
Assigned finding tags:

StabilityPool::getExchangeRate hardcodes 1:1 ratio instead of calculating real rate, enabling unlimited deToken minting against limited reserves

inallhonesty Lead Judge 8 days ago
Submission Judgement Published
Validated
Assigned finding tags:

StabilityPool::getExchangeRate hardcodes 1:1 ratio instead of calculating real rate, enabling unlimited deToken minting against limited reserves

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.