Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

RAACMinter: wrong calculation of UtilizationRate

ace_30

Summary

The RAACMinter.getUtilizationRate() function calculates the utilization rate incorrectly because lendingPool.getNormalizedDebt() returns reserve.usageIndex instead of the actual total borrowed amount. This results in an inaccurate utilization rate, leading to incorrect emission rate calculations for RAAC tokens.

Vulnerability Details

The problem gets serious because RAACMinter is relied on the result of LendingPool.getNormalizedDebt() .
This is the execution path:

RAACMinter.tick > updateEmissionRate() > calculateNewEmissionRate() > getUtilizationRate() > lendingPool.getNormalizedDebt()

function getUtilizationRate() internal view returns (uint256) {
uint256 totalBorrowed = lendingPool.getNormalizedDebt();
uint256 totalDeposits = stabilityPool.getTotalDeposits();
if (totalDeposits == 0) return 0;
return (totalBorrowed * 100) / totalDeposits;
}
function getNormalizedDebt() external view returns (uint256) {
return reserve.usageIndex;
}

In utilization rate calculation:

  • totalBorrowed equals to usageIndex (which is > 1 RAY)

  • totalDeposits is balance of RAAC tokens (which can be e18 or other decimals)

So utilization rate can be any number from 0 to 1e9 based on the token decimals and usageIndex.

NOTE: It also assumes that decimals of totalBorrowed (asset) and totalDeposits (rTokens) are same.

Impact

Wrong emission rate will lead to unfair distribution of RAAC tokens among users

Tools Used

vscode

Recommendations

Change LendingPool.getNormalizedDebt() function to return actual amount of totalDebts

Updates

Lead Judging Commences

inallhonesty Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACMinter::getUtilizationRate incorrectly mixes stability pool deposits with lending pool debt index instead of using proper lending pool metrics

inallhonesty Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACMinter::getUtilizationRate incorrectly mixes stability pool deposits with lending pool debt index instead of using proper lending pool metrics

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.