Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Missing Staleness Check in the LendingPool Contract

cd_pandora

Summary

The LendingPool contract is vulnerable to undercollateralized borrowing due to a missing staleness check in the price oracle function. The contract fetches NFT prices without verifying if the data is recent, allowing users to borrow against outdated and potentially inflated collateral values.

Vulnerability Details

2025-02-raac/contracts/core/pools/LendingPool/LendingPool.sol at main · Cyfrin/2025-02-raac

In the borrow() function, the contract calculates the user's collateral value using:

uint256 collateralValue = getUserCollateralValue(msg.sender);
​

The function getUserCollateralValue() internally calls getNFTPrice(tokenId), which fetches the price from the oracle:

/**
* @notice Gets the current price of an NFT from the oracle
* @param tokenId The token ID of the NFT
* @return The price of the NFT
*
* Checks if the price is stale
*/
function getNFTPrice(uint256 tokenId) public view returns (uint256) {
(uint256 price, uint256 lastUpdateTimestamp) = priceOracle.getLatestPrice(tokenId);
//Wrong staleness check
if (price == 0) revert InvalidNFTPrice();
return price;
}

The function returns the last recorded price and timestamp but does not verify if the timestamp is recent.

Same here after checking the getLatestPrice(tokenId) call

2025-02-raac/contracts/core/primitives/RAACHousePrices.sol at main · Cyfrin/2025-02-raac

function getLatestPrice(
uint256 _tokenId
) external view returns (uint256, uint256) {
// No staleness check
return (tokenToHousePrice[_tokenId], lastUpdateTimestamp);
}

Impact

Users can borrow more than allowed, leading to undercollateralization.

Tools Used

Recommendations

Validate timestamp before using collateral value:

// Replace 30 minutes with your intended price update frquency
​
require(block.timestamp - lastUpdateTimestamp <= 1 days, "Stale NFT price from oracle");
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::getNFTPrice or getPrimeRate doesn't validate timestamp staleness despite claiming to, allowing users to exploit outdated collateral values during price drops

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::getNFTPrice or getPrimeRate doesn't validate timestamp staleness despite claiming to, allowing users to exploit outdated collateral values during price drops

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.