Core Contracts

Summary

The interest compounding system inside the RAAC LendingPool doesn't account for the pause duration.

Vulnerability Details

The protocol allows global pausing, which restricts deposits, withdrawals, borrowing, repaying, and liquidations. However, the interest compounding mechanism does not account for the pause duration. This means that borrowers continue accruing interest even when they are unable to repay due to a paused state, leading to an unfair increase in debt.

Impact

Borrowers are penalized even when repaying is impossible, and their loan amount grows excessively over the paused period. As interest accrues, users may unfairly exceed liquidation thresholds, causing unexpected liquidations when the system is unpaused. If many borrowers face forced liquidations, it could lead to cascading and mass liquidations, destabilizing the lending pool.

POC

1. Bob takes a 10,000 USDC loan with 5% annual interest (compounded).

2. The system pauses for 30 days, preventing Bob from repaying.

3. The interest accrues during the pause, increasing Bob's debt to:

Debt = 10,000 * e^(0.05 * 30/365) ≈ 10,041 USDC

4. When unpaused, Bob now owes 41 USDC more, even though he was forbidden from repaying for that period.

5. If Bob was near his liquidation threshold, he might get liquidated due to this unexpected debt increase.

Tools Used

Manual

Recommendations

Consider storing pause / unpause timestamp to allow skipping borrow interests compounding for the duration of the pause.