Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Lack of an update call can cause issues with users funds and the liquidity index

bigsam

Summary

When updating the system protocol fee we fail to update the entire state of the system, This creates an in consistency in the liquidity that can see the protocol leak funds when these rates are reduced .

Vulnerability Details

Setting protocol without updating the system first will affect users' liquidity index and supplied total has if the fee is lower the user automatically becomes the owner of the this lost protocol amount in the next yiel

​
/**
* @notice Sets the protocol fee rate
* @param newProtocolFeeRate The new protocol fee rate (in RAY)
*/
function setProtocolFeeRate(uint256 newProtocolFeeRate) external onlyOwner { // bug UPDATE state first
rateData.protocolFeeRate = newProtocolFeeRate; // NO FUNCTION TO RETRIEVE PROTOCOLFEE High
}
​

Deducted from the globalliquidity

/**
* @notice Calculates the liquidity rate based on utilization and usage rate.
* @param utilizationRate The current utilization rate (in RAY).
* @param usageRate The current usage rate (in RAY).
* @param protocolFeeRate The protocol fee rate (in RAY).
* @return The liquidity rate (in RAY).
*/
function calculateLiquidityRate(uint256 utilizationRate, uint256 usageRate, uint256 protocolFeeRate, uint256 totalDebt) internal pure returns (uint256) {
if (totalDebt < 1) {
return 0;
}
​
uint256 grossLiquidityRate = utilizationRate.rayMul(usageRate);
​
@audit>> uint256 protocolFeeAmount = grossLiquidityRate.rayMul(protocolFeeRate);
@audit>> uint256 netLiquidityRate = grossLiquidityRate - protocolFeeAmount;
​
return netLiquidityRate;
}
​

Impact

Users can steal the fee difference between the former and new fee, also higher fees/ lower fee than we should remove will be deducted from the contract.

Tools Used

Manual Review

Recommendations

Update the state of the system before processing any changes to protocol fee.

Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

ReserveLibrary fails to update reserve state before changing rate parameters (prime rate, protocol fee rate), causing new rates to be applied retroactively to interest since last update

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

ReserveLibrary fails to update reserve state before changing rate parameters (prime rate, protocol fee rate), causing new rates to be applied retroactively to interest since last update

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.