# The return value success of the get function of the INFTOracle interface is not checked

NFTPairWithOracle ignores the success flag from INFTOracle.get, so a failed oracle call yields stale rate data and mispriced NFT loans.

- Payout: Audit contest
- Severity: high
- Program: Abracadabra Money
- Credited: cccz
- Disclosed: 2022-07-18
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-04-abranft-findings/issues/21
- Library page: https://bugbountylibrary.com/r/c4%3A2022-04-abranft%3AH-02
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:oracle-manipulation

**Target:** NFTPairWithOracle NFT lending contract / INFTOracle price feed
**Root cause:** INFTOracle.get returns (bool success, uint256 rate) but NFTPairWithOracle destructures only the rate and never checks success, so a failed oracle read silently returns stale/zero data used for loan pricing.
**Steps:**
1. Read INFTOracle.get signature: `function get(address pair, uint256 tokenId) external returns (bool success, uint256 rate);`
2. Observe NFTPairWithOracle.sol L287 and L321 call `loanParams.oracle.get(address(this), tokenId)` and use the rate without checking success
3. Trigger oracle failure (success=false) so stale rate is consumed for loan valuation
4. Borrow/repay against mispriced NFT to extract value
**How found:** Code review of the oracle interface versus its call sites: noticed the two-value return signature and that callers only captured the rate, flagging the unchecked success boolean.
**Exploitation:** Attacker induces or waits for oracle failure so success=false; contract proceeds with stale rate, enabling loans at incorrect valuations and asset loss to the protocol.
**Insight:** When an oracle interface returns a success boolean alongside data, grep every call site for destructuring that drops the flag; stale-price paths are a direct funds-loss vector in lending protocols.