Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Incorrect getutilizationrate calculation in RAACMinter.sol

anonymousjoe

Summary

In the getUtilizationRate() function in the RAACMinter.sol, the totalBorrowed is in e27 scale and totalDeposits is in e18 scale, this causes the utiliaztion rate to be always greater than the utilizationTarget (70), and thus cause emission to be always max emission.

Vulnerability Details

The totalBorrowed is the usageIndex of the lending pool, which is in RAY thus is of the order 1e27.And the totalDeposits is the amount of RToken presen in the stability Pool and thus is of the order 1e18 (decimals of Rtoken). Thus the utiliaztion rate would be of ther oder
1e27*100/1e18 = 1e11.

This is greater than the utilization target of 70. Thus the calculation is incorrect.

function getUtilizationRate() internal view returns (uint256) {
uint256 totalBorrowed = lendingPool.getNormalizedDebt();
uint256 totalDeposits = stabilityPool.getTotalDeposits();
if (totalDeposits == 0) return 0;
return (totalBorrowed * 100) / totalDeposits;
}
​

Impact

More emission of RAAC token than intended.

Tools Used

manual review

Recommendations

scale them to the same order.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACMinter::getUtilizationRate incorrectly mixes stability pool deposits with lending pool debt index instead of using proper lending pool metrics

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACMinter::getUtilizationRate incorrectly mixes stability pool deposits with lending pool debt index instead of using proper lending pool metrics

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!