Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

wrong utilizationRate calculation in `RAACMinter.sol`

maa_ly

Summary

getUtilizationRate function returns the utilizationrate by getting the NormalizedDebt from the lendingpool and getting the TotalDeposits from the stabilityPool. The issue here is that the getNormalizedDebt function returns the reserve.usageIndex. But the getUtilizationRate function treats it a the totalBorrowed which isnt the case. This lead to utilizationRate being wrongly calculated.

Vulnerability Details

vulnerability line

// RAACMinter.sol
//totalBorrowed. The usageIndex is a scaling factor that accounts for compounded interest, but it does not include the actual borrowed amount (totalUsage).
function getUtilizationRate() internal view returns (uint256) {
uint256 totalBorrowed = lendingPool.getNormalizedDebt();
uint256 totalDeposits = stabilityPool.getTotalDeposits();
if (totalDeposits == 0) return 0;
return (totalBorrowed * 100) / totalDeposits;
}
​
​
//LendingPool.sol
​
function getNormalizedDebt() external view returns (uint256) {
return reserve.usageIndex; // <==== returns the Usageindex
}

The usageIndex is a scaling factor that must be multiplied by totalUsage to calculate the actual totalBorrowed.

Impact

The calculateNewEmissionRate function uses the utilization rate to adjust the emission rate. If the utilization rate is incorrectly calculated, the emission rate will also be incorrectly adjusted.

Tools Used

manual review

Recommendations

Multiply totalUsage by usageIndex / 10^{27} to compute the real borrowed amount.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACMinter::getUtilizationRate incorrectly mixes stability pool deposits with lending pool debt index instead of using proper lending pool metrics

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACMinter::getUtilizationRate incorrectly mixes stability pool deposits with lending pool debt index instead of using proper lending pool metrics

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!