Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Incorrect utilization rate calculation uses interest index instead of total borrowed amount, leading to extreme emission rates

0xekkoo

Summary

The RAACMinter's utilization rate calculation incorrectly uses the lending pool's usage index (normalized debt) instead of the actual total borrowed amount, resulting in extremely high utilization rates and incorrect emission rate adjustments.

Vulnerability Details

In RAACMinter, the getUtilizationRate function uses the wrong value for total borrowed amount:

function getUtilizationRate() internal view returns (uint256) {
uint256 totalBorrowed = lendingPool.getNormalizedDebt();
uint256 totalDeposits = stabilityPool.getTotalDeposits();
if (totalDeposits == 0) return 0;
return (totalBorrowed * 100) / totalDeposits;
}

Because the getNormalizedDebt on lending pool retrieves the usage index not the actual total borrowed:

function getNormalizedDebt() external view returns (uint256) {
return reserve.usageIndex;
}

Sample Scenario

  1. Assume the ff:

  • usageIndex = 1e27 (RAY)

  • totalDeposits = 1000e18 tokens

  1. Calculation:

  • utilizationRate = (1e27 100) / (1000e18)

  • = 1e29 / 1e21

  • = 100,000,000

  1. Expected:

  • utilizationRate = (actualBorrowed 100) / totalDeposits

  • = value between 0-100

Impact

Protocol's emission rate mechanism breaks due to extremely high utilization rate calculations, leading to maximum emission rates and incorrect token distribution.

Tools Used

Manual Review

Recommendations

Ensure that the totalBorrowed amount really retrieves the total borrowed in the lending pool.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACMinter::getUtilizationRate incorrectly mixes stability pool deposits with lending pool debt index instead of using proper lending pool metrics

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACMinter::getUtilizationRate incorrectly mixes stability pool deposits with lending pool debt index instead of using proper lending pool metrics

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!