Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Inconsistent tracking of total debt and liquidity leads to incorrect utilization rate calculation

greese

Summary

Both the total liquidity and debt are used to calculate the utilization rate. The problem is that total debt is being scaled down when getting the total supply but total liquidity is not leading to an incorrect utilization rate calculation.

Vulnerability Details

Lets first take a look at how total liquidity is tracked. A user calls deposit and transfers a certain amount of a reserve asset. In the Reserve deposit function it passes the amount deposited into the updateInterestRatesAndLiquidity function where it is directly added to the liquidity amount and not scaled by the liquidity index.

function updateInterestRatesAndLiquidity(ReserveData storage reserve,ReserveRateData storage rateData,uint256 liquidityAdded,uint256 liquidityTaken) internal {
// Update total liquidity
if (liquidityAdded > 0) {
reserve.totalLiquidity = reserve.totalLiquidity + liquidityAdded.toUint128();
}

Now if we look at how totalUsage is tracked we first start at the borrow function where the debt token is minted. newTotalSupply is returned which is then used as the totalUsage amount. When we look at how the totalSupply of the debt token is calculated, it returns the scaled version of it using the usage index.

/**
* @notice Returns the scaled total supply
* @return The total supply (scaled by the usage index)
*/
function totalSupply() public view override(ERC20, IERC20) returns (uint256) {
uint256 scaledSupply = super.totalSupply();
return scaledSupply.rayDiv(ILendingPool(_reservePool).getNormalizedDebt());
}

This is not consistent with how the liquidity is tracked. One is being scaled by its index and the other is not.

Impact

Incorrect utilization rate calculation

Tools Used

Manual Review

Recommendations

Make the total debt and total liquidity consistent.

Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

DebtToken::totalSupply incorrectly uses rayDiv instead of rayMul, severely under-reporting total debt and causing lending protocol accounting errors

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

DebtToken::totalSupply incorrectly uses rayDiv instead of rayMul, severely under-reporting total debt and causing lending protocol accounting errors

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.