Core Contracts

Summary

The index of the RToken is continuously growing, and if all users want to withdraw their rewards simultaneously, it will not be possible due to insufficient liquidity.

Vulnerability Details

The vulnerability arises from the continuous growth of the RToken index, which represents the cumulative interest accrued over time. As the index grows, the amount of underlying assets required to redeem the RTokens also increases. If all users decide to withdraw their rewards at the same time, the protocol may not have enough liquidity to cover the withdrawals, leading to a situation where users cannot redeem their RTokens for the underlying assets.

Example Scenario

Consider the following scenario:

1. The RToken index grows over time due to interest accrual.

2. Users accumulate RTokens based on their deposits and the growing index.

3. At a certain point, the total value of RTokens held by users exceeds the available liquidity in the protocol.

4. If all users attempt to withdraw their rewards simultaneously, the protocol will not have enough underlying assets to cover the withdrawals, leading to failed transactions and user dissatisfaction.

Impact

By allowing the RToken index to grow without sufficient liquidity to back it, the protocol risks creating a situation where users cannot redeem their RTokens for the underlying assets. This can lead to financial losses for users, loss of trust in the protocol, and potential legal and reputational issues for the protocol operators. It undermines the reliability and stability of the protocol, as users expect to be able to withdraw their rewards at any time.

Tools Used

Manual Review

Recommendations

To mitigate this vulnerability, implement mechanisms to ensure that the protocol maintains sufficient liquidity to cover the redemption of RTokens. Here are some recommendations:

1. Liquidity Buffer: Maintain a liquidity buffer to ensure that there are always enough underlying assets to cover potential withdrawals.

2. Withdrawal Limits: Implement withdrawal limits to prevent large-scale withdrawals that could deplete the protocol's liquidity.

3. Dynamic Interest Rates: Adjust interest rates dynamically based on the protocol's liquidity to prevent excessive growth of the RToken index.