Description:
open_loan fetches property.valuation from PropertyRegistry storage, which was set at the last call to update_valuation. There is no freshness check against the oracle at loan origination time. A property owner can:
- Have their property valued at 1 000 000 via oracle.
- Wait for the oracle price to drop to 600 000 (stale).
- Call
open_loan using the inflated stored valuation, borrowing up to 700 000 (70 % of 1 000 000) against collateral worth only 600 000.
Expected behaviour:
open_loan should call OracleAdapter::get_price for the property asset and validate the stored valuation is within an acceptable range, or use the oracle price directly for LTV computation.
Labels: security, contracts, mortgage-pool, high-priority
Description:
open_loanfetchesproperty.valuationfromPropertyRegistrystorage, which was set at the last call toupdate_valuation. There is no freshness check against the oracle at loan origination time. A property owner can:open_loanusing the inflated stored valuation, borrowing up to 700 000 (70 % of 1 000 000) against collateral worth only 600 000.Expected behaviour:
open_loanshould callOracleAdapter::get_pricefor the property asset and validate the stored valuation is within an acceptable range, or use the oracle price directly for LTV computation.Labels:
security,contracts,mortgage-pool,high-priority