Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

`stabilityPool` doesn't distribute the liquidation cost to all depositors

alexczm

Summary

deTokens are minted 1-to-1 to deposited rToken amount. This mechanism doesn't allow the distribution of liquidation costs to be supported by all depositors.

Vulnerability Details

Users can deposit rTokens to StabilityPool and a 1-to-1 amount of deToken is minted.

function calculateDeCRVUSDAmount(uint256 rcrvUSDAmount) public view returns (uint256) { // 1:1 currently, code commented
uint256 scalingFactor = 10**(18 + deTokenDecimals - rTokenDecimals);
@> return (rcrvUSDAmount * scalingFactor) / getExchangeRate(); // @audit equivalent to : `amountIn * 1e18 / 1e18`
}
​
​
/**
* @notice Gets the current exchange rate between rToken and deToken.
* @return Current exchange rate.
*/
function getExchangeRate() public view returns (uint256) {
@> return 1e18;
}

When a borrower is liquidated, its debt is paid from the StabilityPool assets.

Note: there's another issue, reported in a separate submission, related to the wrong asset used to cover the debt. Fixing it doesn't resolve the issue described in this submission.

When a user withdraw, the amount of deToken redeemed is burned and the same amount of rTokens is transferred to user.
Because, after liquidations, StabilityPool will have less tokens than the sum of all deposits, not all depositors are able to withdraw their rTokens.

Impact

The liquidation cost is supported by last withdrawers.

Tools Used

Recommendations

StabilityPool should implement a share-based mechanism (instead of the 1-to-1 deToken minting) so that covered liquidation is supported by all StabilityPool depositors based on their contribution.

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

StabilityPool::getExchangeRate hardcodes 1:1 ratio instead of calculating real rate, enabling unlimited deToken minting against limited reserves

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

StabilityPool::getExchangeRate hardcodes 1:1 ratio instead of calculating real rate, enabling unlimited deToken minting against limited reserves

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.