Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Protocol Fee Handling in Liquidity Rate Calculation

udo

Issue Summary

The function calculateLiquidityRate computes the protocolFeeAmount but does not store or transfer it to an appropriate recipient. This could result in an unintended loss of protocol fees that should be collected.

Affected Code

function calculateLiquidityRate(uint256 utilizationRate, uint256 usageRate, uint256 protocolFeeRate, uint256 totalDebt) internal pure returns (uint256) {
if (totalDebt < 1) {
return 0;
}
​
uint256 grossLiquidityRate = utilizationRate.rayMul(usageRate);
uint256 protocolFeeAmount = grossLiquidityRate.rayMul(protocolFeeRate);
uint256 netLiquidityRate = grossLiquidityRate - protocolFeeAmount;
​
return netLiquidityRate;
}
​

Impact

  • The protocol is not collecting or distributing the computed protocolFeeAmount.

  • This may lead to lost revenue for the protocol or incorrect calculations in downstream functions.

Recommended

  1. Ensure that the protocolFeeAmount is properly recorded in the contract’s state.

  2. Transfer the protocolFeeAmount to the appropriate recipient, such as a protocol treasury or fee collector contract.

  3. Modify the function to return both netLiquidityRate and protocolFeeAmount separately so that the fee can be utilized properly.

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Protocol fees are deducted from depositor returns in liquidity rate calculations but never collected/transferred to protocol treasury, causing value loss

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Protocol fees are deducted from depositor returns in liquidity rate calculations but never collected/transferred to protocol treasury, causing value loss

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.