Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

StabilityPool::getExchangeRate Incorrectly Implemented

zebra

Summary

StabilityPool::getExchangeRate commented out the intended logic.

Vulnerability Details

Likehood: H

Severity: M

The getExchangeRate function in contracts/core/pools/StabilityPool/StabilityPool.sol currently returns a hardcoded value of 1e18, which does not align with the documented behavior:

Gets the current exchange rate between rToken and deToken.

the intended logic, which correctly calculates the exchange rate based on the balances of rToken and deToken, is commented out.

function getExchangeRate() public view returns (uint256) {
// uint256 totalDeCRVUSD = deToken.totalSupply();
// uint256 totalRcrvUSD = rToken.balanceOf(address(this));
// if (totalDeCRVUSD == 0 || totalRcrvUSD == 0) return 10**18;
​
// uint256 scalingFactor = 10**(18 + deTokenDecimals - rTokenDecimals);
// return (totalRcrvUSD * scalingFactor) / totalDeCRVUSD;
return 1e18;
}

Impact

If rToken and deToken have different decimal precisions, the hardcoded return value (1e18) will cause the function to return an incorrect exchange rate. This incorrect rate affects external dependencies, including:

  • library/RPCLibrary/pools/getStabilityPoolInfo.js

  • library/RPCLibrary/pools/liquidityPool/getLiquidityPoolInfo.js

These modules may retrieve and rely on an incorrect exchange rate, potentially leading to miscalculations in pricing, liquidity management, or token conversions.

Tools Used

N/A

Recommendations

Uncomment the intended logic to properly compute the exchange rate dynamically:

function getExchangeRate() public view returns (uint256) {
uint256 totalDeCRVUSD = deToken.totalSupply();
uint256 totalRcrvUSD = rToken.balanceOf(address(this));
if (totalDeCRVUSD == 0 || totalRcrvUSD == 0) return 10**18;
​
uint256 scalingFactor = 10**(18 + deTokenDecimals - rTokenDecimals);
return (totalRcrvUSD * scalingFactor) / totalDeCRVUSD;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

StabilityPool::getExchangeRate hardcodes 1:1 ratio instead of calculating real rate, enabling unlimited deToken minting against limited reserves

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

StabilityPool::getExchangeRate hardcodes 1:1 ratio instead of calculating real rate, enabling unlimited deToken minting against limited reserves

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.