Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

The hardcoded 500bps prime rate change limit may prevent necessary adjusments, causing unfair lending/borrowing conditions

alexczm

Summary

The setPrimeRate function imposes a hardcoded maximum change of 500 basis points (5%) from the old value. This restriction may be too limiting, preventing necessary adjustments in volatile market conditions or during significant economic shifts.

Vulnerability Details

The primeRate can be changed when the admin request is fulfilled by Chainlink Functions. The response is processed in _processResponse hook, which calls lendingPool::setPrimeRate -> ReserveLibrary::setPrimeRate

In setPrimeRate, the new prime rate is compared to the old prime rate, and any change exceeding 5% from the previous value is reverted:

// ReserveLibrary.sol
function setPrimeRate( ReserveData storage reserve,ReserveRateData storage rateData,uint256 newPrimeRate) internal {
if (newPrimeRate < 1) revert PrimeRateMustBePositive();
​
uint256 oldPrimeRate = rateData.primeRate;
​
if (oldPrimeRate > 0) {
@> uint256 maxChange = oldPrimeRate.percentMul(500); // Max 5% change
uint256 diff = newPrimeRate > oldPrimeRate ? newPrimeRate - oldPrimeRate : oldPrimeRate - newPrimeRate;
@> if (diff > maxChange) revert PrimeRateChangeExceedsLimit();
}
​
rateData.primeRate = newPrimeRate;
updateInterestRatesAndLiquidity(reserve, rateData, 0, 0);
​
emit PrimeRateUpdated(oldPrimeRate, newPrimeRate);
}

While this mechanism prevents drastic changes, it may also prevent the system from adjusting the prime rate when needed.

For example for an oldPrimeRate of 5% == 500bps the maxChange is:

maxChange = (500 * 500 + 5000) / 10_000 = 255_000 / 10_000 = 25bps

The new primeRate can't exceed 525pbs.
If we check the historycal prime rate, in most cases, the month over month change exceeds the 5% limit.

Impact

The protocol may be unable to update the prime rate, causing unfair lending/borrowing conditions or liquidity imbalances.

Tools Used

Recommendations

Consider the following changes:

  • Instead of a fixed 5% cap, consider basing the maximum change on historical volatility, market conditions.

  • Make the percentage cap configurable by admin/ governance.

Updates

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.