Core Contracts

Summary

The NatSpec documentation for the setHousePrice function incorrectly states that it allows the owner to set the house price for a token, while the implementation restricts access to accounts with the onlyOracle role. This discrepancy creates ambiguity regarding who is authorized to update house prices. Additionally, the function does not verify whether the token exists before updating its price.

Vulnerability Details

• NatSpec vs. Implementation Mismatch:
  The NatSpec comment describes the function as being callable by the owner:

  /**

  * @notice Allows the owner to set the house price for a token

  * @param _tokenId The ID of the RAAC token

  * @param _amount The price to set for the house in USD

  */

  However, the function is defined with the onlyOracle modifier:

  function setHousePrice(

  uint256 _tokenId,

  uint256 _amount

  ) external onlyOracle { ... }

  This mismatch leads to confusion about whether the function is intended to be restricted to the owner or to an oracle.

Impact

• Access Control Confusion:
  Stakeholders might assume that the owner is responsible for setting house prices when, in fact, only an account with the onlyOracle role can perform this operation. This can lead to misconfigurations and potential security gaps if the intended access control is not enforced.

Tools Used

• Manual code review

Recommended Mitigation

• Clarify the NatSpec Documentation:
  If the intended caller is the oracle, update the NatSpec comment to reflect that the function allows the oracle (and not the owner) to set the house price:

  /**

  * @notice Allows the oracle to set the house price for a token

  * @param _tokenId The ID of the RAAC token

  * @param _amount The price to set for the house in USD

  *

  * Updates the timestamp for each token individually.

  */

• Review and Adjust Access Control:
  Determine the intended role:

  • If the owner should set the house price, change the modifier from onlyOracle to onlyOwner.

  • If the oracle is intended to set the price, ensure that the documentation and role management are updated accordingly.