Core Contracts

Summary

The RAAC protocol documentation specifies that:

• updatePriceFromOracle function should be callable the oracle in order to update the price of a token.

• setHousePrice should be callable the owner to manually set the price of a house

The problem arises because the code behaves differently:

• no updatePriceFromOracle function

• setHousePrice function only callable by the oracle

• No ability of the owner to manually set the price of a house

Note that the documentation also specifies that the Owner role is "for setting the oracle address and manual price updates".

Vulnerability Details

The issue lies in the fact that the implementation doesn't follow specification (updatePriceFromOracle for oracle price update, setHousePrice for owner price update).

Impact

The impact is low, as it is only a discrepancy between specification and implementation.

Tools Used

Manual review.

Recommendations

Update the documentation to remove the updatePriceFromOracle function and remove information that the owner can manually update the price of a token (if this is not a desired behaviour).