Submission Details
Severity:
loss of revenue for protocol
Summary
Protocol is used without paying any protocol fee in the LendingPool contract.
Vulnerability Details
Fee Rate Configuration in the LendingPool contract is set to 0.
// In constructor
rateData.protocolFeeRate = 0; // 0% in RAY (27 decimals)
// Setter function exists
function setProtocolFeeRate(uint256 newProtocolFeeRate) external onlyOwner {
rateData.protocolFeeRate = newProtocolFeeRate;
}
Even if owner sets a non-zero protocolFeeRate, no fees are collected
Fee Calculation in ReserveLibrary:
function calculateLiquidityRate(
uint256 utilizationRate,
uint256 usageRate,
uint256 protocolFeeRate,
uint256 totalDebt
) internal pure returns (uint256) {
if (totalDebt < 1) {
return 0;
}
uint256 grossLiquidityRate = utilizationRate.rayMul(usageRate);
@>> uint256 protocolFeeAmount = grossLiquidityRate.rayMul(protocolFeeRate);
uint256 netLiquidityRate = grossLiquidityRate - protocolFeeAmount;
return netLiquidityRate;
}
No actual fee collection occurs in operations:
deposit()
withdraw()
borrow()
repay()
liquidateBorrower()
Impact
Protocol loses revenue from all operations as all user operations effectively become fee-free regardless of configured rate
Tools Used
Manual Review
Recommendations
Implement a fee collection mechanism for protocol revenue.
Updates
Lead Judging Commences
inallhonesty 3 months ago
Submission Judgement Published Assigned finding tags:
LendingPool calculates protocol fees but lacks mechanism to track and withdraw them, causing fees to be permanently locked in the RToken contract
inallhonesty 3 months ago
Submission Judgement Published Assigned finding tags:
LendingPool calculates protocol fees but lacks mechanism to track and withdraw them, causing fees to be permanently locked in the RToken contract
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.