Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

The emission rate of the raac minter is wrong

0xphantom

Summary

To compute the emission rate, the protocol calculates the utilization rate. However, the protocol uses an incorrect formula, causing the emission rate to be completely inaccurate.

Vulnerability Details

The utilization rate is used to determine the emission rate, as seen in RAACMinter at L-220. The protocol relies on the function getNormalizedDebt to obtain the debt.

function calculateNewEmissionRate() internal view returns (uint256) {
uint256 utilizationRate = getUtilizationRate();
uint256 adjustment = (emissionRate * adjustmentFactor) / 100;
​
if (utilizationRate > utilizationTarget) {
uint256 increasedRate = emissionRate + adjustment;
uint256 maxRate = increasedRate > benchmarkRate ? increasedRate : benchmarkRate;
return maxRate < maxEmissionRate ? maxRate : maxEmissionRate;
} else if (utilizationRate < utilizationTarget) {
uint256 decreasedRate = emissionRate > adjustment ? emissionRate - adjustment : 0;
uint256 minRate = decreasedRate < benchmarkRate ? decreasedRate : benchmarkRate;
return minRate > minEmissionRate ? minRate : minEmissionRate;
}
​
return emissionRate;
}

And the utilisation rate use the function getNormalizedDebt to have the debt.

function getUtilizationRate() internal view returns (uint256) {
uint256 totalBorrowed = lendingPool.getNormalizedDebt();
uint256 totalDeposits = stabilityPool.getTotalDeposits();
if (totalDeposits == 0) return 0;
return (totalBorrowed * 100) / totalDeposits;
}

The issue is that this function does not return the total borrowed amount but instead returns the usage index, as shown here:

function getNormalizedDebt() external view returns (uint256) {
return reserve.usageIndex;
}

As a result, the emission rate may sometimes decrease when it should increase or increase when it should decrease.

Impact

This leads to an incorrect computation of the emission rate, disrupting a critical functionality of the protocol.

Tools Used

Manual review

Recommendations

the protocol should refactor the getUtilizationRate function to use the borrowed amount

Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACMinter::getUtilizationRate incorrectly mixes stability pool deposits with lending pool debt index instead of using proper lending pool metrics

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACMinter::getUtilizationRate incorrectly mixes stability pool deposits with lending pool debt index instead of using proper lending pool metrics

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.