Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Prime Rate Minimum Value of 1 Results in Zero Protocol Fees

0xterrah

Relevant GitHub Links

https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/libraries/pools/ReserveLibrary.sol#L400

Summary

The setPrimeRate() function in ReserveLibrary.sol validates the prime rate against a minimum value of 1, but this minimum value when used to calculate protocol rates results in effectively zero fees.

Vulnerability Details

In ReserveLibrary.sol, prime rate is validated against value of 1:

function setPrimeRate(ReserveData storage reserve, ReserveRateData storage rateData, uint256 newPrimeRate) internal {
// @audit: this, perhaps, meant to be scaled to 1%
if (newPrimeRate < 1) revert PrimeRateMustBePositive();
// ...
}

When prime rate of 1 is used to calculate protocol rates:

rateData.baseRate = rateData.primeRate.percentMul(25_00); // 25% of 1 = ~0
rateData.optimalRate = rateData.primeRate.percentMul(50_00); // 50% of 1 = ~0
rateData.maxRate = rateData.primeRate.percentMul(400_00); // 400% of 1 = ~0

Since other rates are calculated as percentages of prime rate using percentMul, setting prime rate to 1 results in all protocol rates being effectively zero.

Impact

  • Base rate, optimal rate and max rate all become effectively zero

  • Protocol cannot collect meaningful fees

  • Core revenue mechanism becomes non-functional

Tools Used

Manual Review

Recommendations

Implement meaningful minimum prime rate validation:

function setPrimeRate(ReserveData storage reserve, ReserveRateData storage rateData, uint256 newPrimeRate) internal {
// Minimum value that would result in meaningful protocol rates
if (newPrimeRate < 1000) revert PrimeRateTooLow();
// ...
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!