Core Contracts

Summary

The RAACMinter contract calculates the system utilization rate using the value returned by lendingPool.getNormalizedDebt(), which actually returns the usageIndex (in RAY, or 1e27 precision) instead of the true debt value. This miscalculation results in an erroneously high utilization rate, thereby triggering inappropriate emission rate adjustments.

Vulnerability Details

The utilization rate in the RAACMinter contract is computed as follows:

• LendingPool Implementation:
  The getNormalizedDebt() function in the LendingPool contract returns reserve.usageIndex, which is initialized as follows in the constructor:

  reserve.usageIndex = uint128(WadRayMath.RAY); // 1e27

  This usageIndex is maintained in RAY precision and does not represent the actual debt value.

• Correct Debt Value:
  The actual debt value is stored in reserve.totalUsage in the ReserveData structure:

  struct ReserveData {

  // ...

  uint256 totalUsage;

  uint128 liquidityIndex;

  uint128 usageIndex;

  // ...

  }

  Using usageIndex instead of totalUsage leads to an incorrect calculation.

• Emission Rate Adjustment:
  The computed utilization rate is then used in the calculateNewEmissionRate() function:

Proof-of-Concept (POC)

1. Initial Conditions:

   • Assume lendingPool.getNormalizedDebt() returns 1e27 (the initial usageIndex).

   • Assume stabilityPool.getTotalDeposits() returns 100e18 (representing 100 tokens with 18 decimals).

2. Expected Calculation:

   • If the actual borrowed amount were 50 tokens, the correct utilization rate should be:

     (50e18 * 100) / 100e18 = 50%

3. Actual Calculation with Current Implementation:

   • The utilization rate is computed as:

     (1e27 * 100) / 100e18 = (1e27 * 100) / 1e20 = 1e7 = 10,000,000%

   • This result is many orders of magnitude higher than expected, leading the system to believe that utilization is excessively high.

4. Emission Adjustment Impact:
   Given the utilization target is 70% and the adjustment factor is 5%, the erroneous high utilization rate would trigger the logic in calculateNewEmissionRate() to increase or cap the emission rate at the maximum allowed, resulting in unintended token emission levels.

Impact

• The inflated utilization rate can trigger inappropriate adjustments to the emission rate, potentially resulting in drastic changes to token minting.

• The utilization rate is vastly overestimated, which could lead to an incorrect adjustment of the emission rate.

Tools Used

Manual Review

Recommendations

Update the getUtilizationRate() function to use the actual debt value (reserve.totalUsage) instead of the usageIndex. This will ensure accurate utilization calculations and proper emission rate adjustments.