Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

`getUtilizationRate` Does Not Consider Different Decimals

ChainDefenders

Summary

The function getUtilizationRate in the RAACMinter contract does not properly account for differences in token decimals. The issue arises because:

  1. totalBorrowed is stored in RAY (27) decimals.

  2. totalDeposits is derived from RToken balance, which may have different decimals.

Relevant Code

function getUtilizationRate() internal view returns (uint256) {
uint256 totalBorrowed = lendingPool.getNormalizedDebt();
uint256 totalDeposits = stabilityPool.getTotalDeposits();
if (totalDeposits == 0) return 0;
return (totalBorrowed * 100) / totalDeposits;
}

Vulnerability Details

Example Scenario:

  • RToken has 6 decimals (1,000,000 = 1 RToken)

  • totalBorrowed is 1000 (1000e27)

  • totalDeposits is 2000 (2000e6)

  • This results in (totalBorrowed * 100) / totalDeposits = 5e22, way more than the intended range of 0 - 100

This will cause wrong calculations related to this utilization ratio.

Impact

Incorrect Emission Rate Calculation: calculateNewEmissionRate will use a wrong utilization rate leading to wrong calculations.

Tools Used

Manual Review

Recommendations

Ensure all token values are converted to the same decimal standard before calculations. Ensure at the end that the utilization rate is in the intended range.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACMinter::getUtilizationRate incorrectly mixes stability pool deposits with lending pool debt index instead of using proper lending pool metrics

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACMinter::getUtilizationRate incorrectly mixes stability pool deposits with lending pool debt index instead of using proper lending pool metrics

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!