Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

hardcoded exchange Rate will lead to arbitrage

buggsyes

Summary

Hardcoding Exchange Rate to 1e18 makes the system assume that the value of deCRVUSD and RcrvUSD is always 1:1 (the same)
leading to Arbitrage when they are not pegged 1:1 .

Vulnerability Details

When exchanging deCRVUSD for RcrvUSD happens currently through the deposit and withdraw mechanism it assumes that 1:1 value will be held always
but that cannot be guaranteed . if TotalSupply / Value Changes in one of the tokens an arbitrage opportunity will be created where people will abuse the hardcoded 1e18 exchange rate for the tokens , exchanging the less valuable asset for the better priced one essentially profiting till one of the tokens is left worthless .

function getExchangeRate() public view returns (uint256) {
// uint256 totalDeCRVUSD = deToken.totalSupply();
// uint256 totalRcrvUSD = rToken.balanceOf(address(this));
// if (totalDeCRVUSD == 0 || totalRcrvUSD == 0) return 10**18;
​
// uint256 scalingFactor = 10**(18 + deTokenDecimals - rTokenDecimals);
// return (totalRcrvUSD * scalingFactor) / totalDeCRVUSD;
return 1e18;
}

Impact

Hardcoded Exchange Rate 1e18 can lead to arbitrage and loss of funds .

Tools Used

manual review

Recommendations

possible fixes :

1.incorporate Chainlink Oracle to fetch prices of the two tokens and compare them when calculating exchange Rate .
2.TotalSupply Comparison to maintain an accurate valuation based on total circulation of the two tokens (could be manipulated).
the commented version also takes uint256TotalrcrvUSD= rToken.balanceOf(address(this)); which will not account properly for all of the rcrvUSD in circulation only for rcrvUSD that is in the StabilitityPool currently .

Updates

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

StabilityPool::getExchangeRate hardcodes 1:1 ratio instead of calculating real rate, enabling unlimited deToken minting against limited reserves

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

StabilityPool::getExchangeRate hardcodes 1:1 ratio instead of calculating real rate, enabling unlimited deToken minting against limited reserves

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.