Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

StabilityPool Incorrect Exchange Rate

aariiif

Summary

StabilityPool's getExchangeRate() function hardcodes a static 1e18 rate, allowing attackers to mint unlimited deTokens without proper rToken backing, leading to protocol insolvency.

function getExchangeRate() public view returns (uint256) {
return 1e18; // Static rate ignores actual pool state
}

Vulnerability Details

The getExchangeRate function is hardcoded to 1e18, ignoring actual token balances. This breaks the intended 1:1 peg between rToken and DEToken.

Current code: getExchangeRate()

function getExchangeRate() public view returns (uint256) {
return 1e18; // Hardcoded 1:1 rate
}

This static rate ignores the actual pool dynamics that should determine the exchange rate:

  • Total rToken deposits

  • Outstanding deToken supply

  • Liquidation events

  • Protocol fees

Imagine this scenario:

  1. Attacker deposits minimal rToken

  2. Receives deToken at 1:1 rate

  3. Pool becomes undercollateralized

  4. System insolvency when redemptions exceed deposits

Impact

Users can mint unlimited DEToken without sufficient backing, leading to insolvency.

Tools Used

Manual review

Recommendations

Implement dynamic exchange rate calculation using actual balances (uncomment the existing logic and validate).

function getExchangeRate() public view returns (uint256) {
uint256 totalDeCRVUSD = deToken.totalSupply();
uint256 totalRcrvUSD = rToken.balanceOf(address(this));
// Initial rate for empty pool
if (totalDeCRVUSD == 0 || totalRcrvUSD == 0) return 1e18;
// Calculate real-time exchange rate based on pool balances
uint256 scalingFactor = 10**(18 + deTokenDecimals - rTokenDecimals);
return (totalRcrvUSD * scalingFactor) / totalDeCRVUSD;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

StabilityPool::getExchangeRate hardcodes 1:1 ratio instead of calculating real rate, enabling unlimited deToken minting against limited reserves

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

StabilityPool::getExchangeRate hardcodes 1:1 ratio instead of calculating real rate, enabling unlimited deToken minting against limited reserves

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.