Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Inadequate Access Control in setHousePrice Function

cd_pandora

Summary

The setHousePrice function in the RAAC protocol lacks proper access control, allowing only the oracle to update house prices. This contradicts the documentation, which specifies that the function should be "Owner Only." The missing implementation of the onlyOwner modifier creates a potential vulnerability when the oracle reports incorrect or stale prices.

Vulnerability Details

2025-02-raac/contracts/core/primitives/RAACHousePrices.sol at main · Cyfrin/2025-02-raac

The function uses the onlyOracle modifier, which restricts access to only the oracle.

The documentation states that the function should be "Owner Only," yet the contract permits oracle access without owner override capabilities for manual corrections.

Impact

  • Incorrect or Stale Prices: If the oracle provides incorrect or outdated prices, the owner cannot manually correct them, potentially causing financial discrepancies within the protocol.

  • Limited Control: The owner’s inability to intervene will affect the protocol's stability, especially during oracle failures or compromised oracle scenarios.

Tools Used

Recommendations

Add this Modifier: Replace onlyOracle with onlyOwnerOrOracle to allow both the oracle and the owner to update house prices.

//++
modifier onlyOwnerOrOracle() {
require(msg.sender == oracle || msg.sender == initialOwner, "RAACHousePrices: caller is not authorized");
_;
}
​
//++
function setHousePrice(uint256 _tokenId, uint256 _amount) external onlyOwnerOrOracle {
tokenToHousePrice[_tokenId] = _amount;
lastUpdateTimestamp = block.timestamp;
emit PriceUpdated(_tokenId, _amount);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACHousePrices implementation restricts setHousePrice to oracle only despite documentation stating owner access, preventing manual price corrections during oracle failures

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACHousePrices implementation restricts setHousePrice to oracle only despite documentation stating owner access, preventing manual price corrections during oracle failures

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.