Submission Details
Severity:
RAACMinter Utilization Rate Division by Zero Risk
Summary
After reviewing RAACMinter.sol, I can confirm that the contract already handles zero deposits correctly by explicitly returning 0 for utilization rate, which is then properly handled in the emission calculations.
Vulnerable Code Analysis
function getUtilizationRate() internal view returns (uint256) {
uint256 totalBorrowed = lendingPool.getNormalizedDebt();
uint256 totalDeposits = stabilityPool.getTotalDeposits();
if (totalDeposits == 0) return 0; // Proper handling
return (totalBorrowed * 100) / totalDeposits;
}
function calculateNewEmissionRate() internal view returns (uint256) {
uint256 utilizationRate = getUtilizationRate();
// Proper handling of low utilization
if (utilizationRate < utilizationTarget) {
uint256 decreasedRate = emissionRate > adjustment ? emissionRate - adjustment : 0;
uint256 minRate = decreasedRate < benchmarkRate ? decreasedRate : benchmarkRate;
return minRate > minEmissionRate ? minRate : minEmissionRate;
}
// ...
}
Why This Is Not High Severity
Proper Zero Handling
// Zero deposits case is explicitly handled
if (totalDeposits == 0) return 0;
Emission Logic Safety
// Low utilization properly decreases rate
if (utilizationRate < utilizationTarget) {
// Cannot go below minEmissionRate
return minRate > minEmissionRate ? minRate : minEmissionRate;
}
Bounded Outcomes
// Rate always stays within bounds
uint256 public minEmissionRate = 100 * 1e18 / BLOCKS_PER_DAY;
uint256 public maxEmissionRate = 2000 * 1e18 / BLOCKS_PER_DAY;
Existing Safety Measures
Rate Boundaries
function setMinEmissionRate(uint256 _minEmissionRate) external onlyRole(UPDATER_ROLE) {
if (_minEmissionRate >= maxEmissionRate) revert InvalidMinEmissionRate();
minEmissionRate = _minEmissionRate;
}
function setMaxEmissionRate(uint256 _maxEmissionRate) external onlyRole(UPDATER_ROLE) {
if (_maxEmissionRate <= minEmissionRate) revert InvalidMaxEmissionRate();
maxEmissionRate = _maxEmissionRate;
}
Update Controls
function updateEmissionRate() public whenNotPaused {
if (emissionUpdateInterval > 0 &&
block.timestamp < lastEmissionUpdateTimestamp + emissionUpdateInterval) {
revert EmissionUpdateTooFrequent();
}
// ...
}
Optional Enhancement
While not necessary, could add explicit documentation:
/// @notice Calculates system utilization rate
/// @dev Returns 0 when no deposits exist, triggering minimum emission rate
/// @return Utilization rate as percentage (0-100)
function getUtilizationRate() internal view returns (uint256) {
uint256 totalBorrowed = lendingPool.getNormalizedDebt();
uint256 totalDeposits = stabilityPool.getTotalDeposits();
// Early return for empty pool
if (totalDeposits == 0) {
emit ZeroUtilization();
return 0;
}
return (totalBorrowed * 100) / totalDeposits;
}
event ZeroUtilization();
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420
USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.