Core Contracts

Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Submission Details
Severity: low
Invalid

Interest Rate Calculation Issue in ReserveLibrary

Summary
A critical underflow issue can potentially happen in the calculateLiquidityRate function of the ReserveLibrary contract. The issue could allow for an underflow calculation.

Vulnerability Details
The vulnerability exists in the following code segment:
```solidity

function calculateLiquidityRate(uint256 utilizationRate, uint256 usageRate, uint256 protocolFeeRate, uint256 totalDebt) internal pure returns (uint256) {
if (totalDebt < 1) {
return 0;
}
uint256 grossLiquidityRate = utilizationRate.rayMul(usageRate);
uint256 protocolFeeAmount = grossLiquidityRate.rayMul(protocolFeeRate);
uint256 netLiquidityRate = grossLiquidityRate - protocolFeeAmount; // Vulnerable line
return netLiquidityRate;
}

```
The vulnerability stems from an unchecked subtraction operation where grossLiquidityRate - protocolFeeAmount is performed without any validation that protocolFeeAmount is less than grossLiquidityRate. Since protocolFeeAmount is calculated using rayMul with protocolFeeRate, and there are no constraints on protocolFeeRate, this operation could underflow if protocolFeeRate is equal to or greater than RAY (1e27, representing 100%).

Impact Med/Low

If improperly sets it, protocolFeeRate could cause liquidity rates to underflow or a possibility for them to become invalid, potentially disrupting protocol operations.

Recommendation

Implement an explicit validation check before performing calculations, preventing potential underflow and maintaining expected protocol behavior.

For example:
```solidity
if (newProtocolFeeRate > WadRayMath.RAY) revert ProtocolFeeRateTooHigh();

```

Updates

Lead Judging Commences

inallhonesty Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
inallhonesty Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.