Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Precision Loss in Utilization Rate Calculation Leads to Zero Rates

yaioxy

Summary

The RAACMinter's getUtilizationRate() uses basic integer arithmetic without proper decimal scaling, causing severe precision loss and potentially returning 0% utilization when it should be non-zero.

Vulnerability Details

The current implementation performs integer division after a simple multiplication by 100:

function getUtilizationRate() internal view returns (uint256) {
uint256 totalBorrowed = lendingPool.getNormalizedDebt();
uint256 totalDeposits = stabilityPool.getTotalDeposits();
if (totalDeposits == 0) return 0;
@> return (totalBorrowed * 100) / totalDeposits;
}

When dealing with large numbers in different decimal precisions (18 decimals), this calculation fails to maintain precision:

  • totalBorrowed: 1e18 (1 crvUSD)

  • totalDeposits: 100e18 (100 rToken)

  • Current result: (1e18 * 100) / 100e18 = 0

  • Expected result: 1% = 1e16 in WAD precision

Impact

  • Zero utilization rate reported when actual utilization exists

  • Incorrect emission rate calculations

  • Wrong reward distributions

  • Protocol economics affected by incorrect utilization metrics

  • Potential manipulation of rewards through precision loss

Tools Used

Manual review

Recommendations

Use proper decimal math with WAD precision

function getUtilizationRate() internal view returns (uint256) {
uint256 totalBorrowed = lendingPool.getNormalizedDebt();
uint256 totalDeposits = stabilityPool.getTotalDeposits();
if (totalDeposits == 0) return 0;
- return (totalBorrowed * 100) / totalDeposits;
+ return totalBorrowed.wadDiv(totalDeposits); // Returns in WAD (18 decimals)
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACMinter::getUtilizationRate incorrectly mixes stability pool deposits with lending pool debt index instead of using proper lending pool metrics

inallhonesty Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACMinter::getUtilizationRate incorrectly mixes stability pool deposits with lending pool debt index instead of using proper lending pool metrics

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.