Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

`RAACMinter.getUtilizationRate()` returns incorrect system utilization rate

pabloperezacc6

Summary

The RAACMinter.updateEmissionRate() function updates emissionRate based on the system utilization rate which retrieves from RAACMinter.getUtilizationRate() function. However, this function returns incorrect system utilization rate and so, emissionRate is updated incorrectly.

Vulnerability Details

The RAACMinter.getUtilizationRate() function returns the system utilization rate, however the implementation is incorrect. Let's analyze the following code:

/**
* @dev Calculates the current system utilization rate
* @return The utilization rate as a percentage (0-100)
*/
function getUtilizationRate() internal view returns (uint256) {
@> uint256 totalBorrowed = lendingPool.getNormalizedDebt();
@> uint256 totalDeposits = stabilityPool.getTotalDeposits();
if (totalDeposits == 0) return 0;
return (totalBorrowed * 100) / totalDeposits;
}

The lendingPool.getNormalizedDebt() function returns reserve.usageIndex, but this value is not the total deposit amount and also it uses 1e27 decimal.

The stabilityPool.getTotalDeposits() function returns total deposit amount of rToken to stability pool, however this value does't refer total deposit amount to the system.

Both two values totalBorrowed, totalDeposits are incorrect and function will return incorrect utiliztion rate.

function getNormalizedDebt() external view returns (uint256) {
return reserve.usageIndex;
}
function getTotalDeposits() external view returns (uint256) {
return rToken.balanceOf(address(this));
}

As result, emissionRate could be always maxRate and veRAAC will be minted incorrectly.

function updateEmissionRate() public whenNotPaused {
if (emissionUpdateInterval > 0 && block.timestamp < lastEmissionUpdateTimestamp + emissionUpdateInterval) {
revert EmissionUpdateTooFrequent();
}
@> uint256 newRate = calculateNewEmissionRate();
emissionRate = newRate;
lastEmissionUpdateTimestamp = block.timestamp;
emit EmissionRateUpdated(newRate);
}
​
/**
* @dev Calculates the new emission rate based on the system utilization and benchmark rate
* @return The new emission rate in RAAC per block
*/
function calculateNewEmissionRate() internal view returns (uint256) {
@> uint256 utilizationRate = getUtilizationRate();
uint256 adjustment = (emissionRate * adjustmentFactor) / 100;
​
if (utilizationRate > utilizationTarget) {
...
} else if (utilizationRate < utilizationTarget) {
...
}
​
return emissionRate;
}

Impact

emissionRate will be updated incorrectly and this could result incorrect emission of 'veRAAC` token.

Tools Used

Manual Review

Recommendations

Implement the calculation based on lendingPool.reserve and lendingPool.rateData with ReserveLibrary.

Updates

Lead Judging Commences

inallhonesty Lead Judge 8 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACMinter::getUtilizationRate incorrectly mixes stability pool deposits with lending pool debt index instead of using proper lending pool metrics

inallhonesty Lead Judge 8 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACMinter::getUtilizationRate incorrectly mixes stability pool deposits with lending pool debt index instead of using proper lending pool metrics

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!