Core Contracts

Summary

When the RAACMinter calculates a new emission rate for RAAC tokens, first it calculates the utilization rate (borrows in lending pool and deposits in stability pool), because it plays a role whether the rate will increase or decrease. However in the RAACMinter::getUtilizationRate() function a wrong value is used for calculation, which will enormously inflated the rate, which means large amounts of RAAC tokens will be minted to the Stability pool and later on distributed to users. Users getting large amounts of RAAC tokens means they can lock them in to get veRAAC token and get big voting power and highly influence in the governance decisions of the protocol.

Vulnerability Details

Essentially the utilization rate is expected to be in 0-3 digit value (but of course it depends on the borrows and deposits). Total deposits is the RToken's balance in the Stability Pool and it's expected to be in 18 decimals. However total borrowed amount is the debt index of the Lending pool, which is used to calculated the interest accrued values and is set to in 27 decimals. Now if we calculate the formula using simple values:

• totalBorrowed = 1e27

• totalDeposits = 1e18

• utilization rate = (1e27 * 100) / 1e18 = 100000000000, that means 100,000,000,000%

The problem is that the total borrowed amount also should be in 18 decimals value, if the use the formula again:

• totalBorroed = 1e18

• totalDeposits = 1e18

• utilization rate = 1e18 * 100 / 1e18 = 100, means 100% utilization which is the correct formula.

The new emission rate is applied every time in the RAACMinter::tick() function which triggers the minting process, which is everytime when a user deposits or withdraws to/from the Stability pool.

Impact

Enormously large amounts of RAAC tokens will be minted to the Stability pool, which later will be distributed to users. This way users can increase their voting power in the governance and influence on it's decisions significantly.

Tools Used

Manual Review

Recommendations

reserve.totalUsage should be retrived from the Lending pool, instead ot the reserve.usageIndex