Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Stale Interest Rate Index Leads to Incorrect Utilization Calculation

yaioxy

Summary

The getUtilizationRate() in RAACMinter function uses a stale debt index from LendingPool, leading to inaccurate emission rate calculations and incorrect reward distributions.

Vulnerability Details

When calculating the utilization rate, the function relies on getNormalizedDebt() without updating the lending pool's interest rate index first:

function getUtilizationRate() internal view returns (uint256) {
uint256 totalBorrowed = lendingPool.getNormalizedDebt();
uint256 totalDeposits = stabilityPool.getTotalDeposits();
if (totalDeposits == 0) return 0;
return (totalBorrowed * 100) / totalDeposits;
}

The LendingPool's getNormalizedDebt() returns stale usageIndex:

function getNormalizedDebt() external view returns (uint256) {
return reserve.usageIndex;
}

Impact

  • Incorrect utilization rate calculations

  • Wrong emission rate adjustments

  • Unfair reward distributions

  • Protocol economics affected by stale data

  • Potential manipulation of rewards by timing transactions

Tools Used

Manual Review

Recommendations

Update index before getting normalized debt:

function getUtilizationRate() internal returns (uint256) {
// Update indices first
+ lendingPool.updateState();
uint256 totalBorrowed = lendingPool.getNormalizedDebt();
uint256 totalDeposits = stabilityPool.getTotalDeposits();
if (totalDeposits == 0) return 0;
return (totalBorrowed * 100) / totalDeposits;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::getNormalizedIncome() and getNormalizedDebt() returns stale data without updating state first, causing RToken calculations to use outdated values

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.