Core Contracts

Vulnerability Details

The logic to balance on interest rates based on uitilization should go like this:

• High utilization == Too much money borrowed => High borrow rates to deincentivize borrowing

• Low utilization == Not enough money borrowed => Low borrow rates to incentivize borrowing

The code increases borrow rates when utilization is low, it should decrease them.

Proof Of Concept

See ReserveLibrary::calculateBorrowRate() we can see the behavior mentioned above here. Which is executed after this if statmenet, that checks utilization rate being lower than the optimal.

You can see here that calculateBorrowRate() is called and its return value is used to assign the new borrow rate.

Impact

The system will not self balance properly, leading to slowly increasing borrow rates.

Eventually hitting always teh MAX limit set on code instead of the optimal rate.

Recommendations

Make the borrow rate decrease inside this if statment instead of increasing it. Whether by the actual percentages calculated or new ones, but it must decrease.