Part 2

Summary

The function getCreditCapacityUsd incorrectly calculates credit capacity by adding totalDebtUsdX18 to delegatedCreditUsdX18. Debt should be subtracted from delegated credit. If totalDebtUsdX18 is positive (indicating debt), it increases credit capacity instead of reducing it. If totalDebtUsdX18 is negative (indicating credit), it reduces credit capacity instead of increasing it. This miscalculation leads to incorrect credit capacity evaluations.

Vulnerability Details

The creditCapacityUsdX18 currently is calculated like this:

Uses .add(totalDebtUsdX18), which increases the credit capacity when debt is positive. But it Should subtract totalDebtUsdX18 instead. Credit capacity is the amount left after deducting obligations (debt). Adding debt increases capacity instead of reducing it, which is incorrect.

Impact

• The system assumes a higher credit capacity than it actually has when debt is positive

• If negative debt reduces credit capacity, markets may be restricted from using their full potential credit

Recommendation

Deduct debt from delegated credit before returing: