Core Contracts

Summary

whenever the function tick is called to mint raac tokens as rewards, those raac tokens are minted based on UtilizationRate. If the UtilizationRate is greater than 70, then emissionRate is increased . if the UtilizationRate is less than 70, then emissionRate is decreased. Here UtilizationRate is calculated dividing totalBorrowed by totalDeposits. Here totalBorrowed is total borrowed amount in the lending pool and totalDeposit is total deposit amount in the stability pool.but in the function getUtilizationRate, totalBorrowed i.e lendingPool.getNormalizedDebt calculation is incorrect because lendingPool.getNormalizedDebt returns reserve.usageIndex. As a result, utilization rate calculation will always be bigger than utilizationTarget i.e 70.

Vulnerability Details

**1. Let’s assume, currently totalBorrowed i.e totalBorrowed in the lending pool = 800e18, totalDeposits i.e totalDeposits in the stabilityPool = 1000e18. So utilization rate = (400e18*100)/1000e18 = 40. **

**2. let’s assume , currently reserve.usageIndex = 1.3e27, see function getUtilizationRate(RAACMinter) where totalBorrowed = lendingPool.getNormalizedDebt(this returns reserve.usageIndex) = 1.3e27 and totalDeposits = stabilityPool.getTotalDeposits = 1000e18.So utilization rate = (1.3e27*100)/1000e18 = 130000000. So the utilization rate will always be bigger than utilizationTarget i.e 70. **

3. so even if real utilization rate is less than utilizationTarget, emission rate in RAAC will always increase because totalBorrowed calculation is incorrect and as a result the utilization rate will always be bigger than utilizationTarget i.e 70.

**
**

Impact

** even if real utilization rate is less than utilizationTarget, emission rate in RAAC will always increase because totalBorrowed calculation is incorrect and as a result the utilization rate will always be bigger than utilizationTarget i.e 70.**

Tools Used

manual review

Recommendations

calculate properly totalBorrowed in the function getUtilizationRate.