Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Utilization rate is not correctly calculated in RAACMinter

h2134

Summary

Utilization rate is not correctly calculated in RAACMinter.

Vulnerability Details

The getUtilizationRate() in RAACMinter is implemented as below:

RAACMinter::getUtilizationRate()

/**
* @dev Calculates the current system utilization rate
* @return The utilization rate as a percentage (0-100)
*/
function getUtilizationRate() internal view returns (uint256) {
uint256 totalBorrowed = lendingPool.getNormalizedDebt();
uint256 totalDeposits = stabilityPool.getTotalDeposits();
if (totalDeposits == 0) return 0;
return (totalBorrowed * 100) / totalDeposits;
}

This function calculates the current system utilization rate by dividing totalBorrowed by totalDeposits, unfortunately, there are flaws:

  • totalBorrowed is LendingPool's reserve.usageIndex, which is in RAY (27 decimal) precision, wherease totalDeposits is the RToken balance in StabilityPool, and it is in RToken units (18 decimal), hence the utilization rate would be a much larger value than 100 percentage.

  • Users mint RToken from LendingPool, but not all of them would deposit RToken into StabilityPool, therefore it does not reflect the real system utilization rate.

Impact

In RAACMinter, incorrect utilization rate leads to incorrect emission rate, wrong amount of RAACToken would be minted.

Tools Used

Manual Review

Recommendations

It is recommeded to refer to ReserveLibrary's calculateUtilizationRate():

function calculateUtilizationRate(uint256 totalLiquidity, uint256 totalDebt) internal pure returns (uint256) {
if (totalLiquidity < 1) {
return WadRayMath.RAY; // 100% utilization if no liquidity
}
uint256 utilizationRate = totalDebt.rayDiv(totalLiquidity + totalDebt).toUint128();
return utilizationRate;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACMinter::getUtilizationRate incorrectly mixes stability pool deposits with lending pool debt index instead of using proper lending pool metrics

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACMinter::getUtilizationRate incorrectly mixes stability pool deposits with lending pool debt index instead of using proper lending pool metrics

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!