Submission Details
Severity:
Emission rate is calculated incorrectly in raac minter contract
Summary
Emission rate is calculated incorrectly in raac minter contract due to usage of incorrect variables.
Vulnerability Details
Following is how utilization rate is calculated
function getUtilizationRate() internal view returns (uint256) {
uint256 totalBorrowed = lendingPool.getNormalizedDebt();
uint256 totalDeposits = stabilityPool.getTotalDeposits();
if (totalDeposits == 0) return 0;
return (totalBorrowed * 100) / totalDeposits;
}
Now get normalized debt doesn't returns the total debt instead it is the factor by which the debt has increased so it is not the correct variable which should be used to calculate the utilization rate.
Impact
Utilization rate calculated incorrectly
Tools Used
Manual review
Recommendations
Re-design this function
Updates
Lead Judging Commences
inallhonesty 4 months ago
Submission Judgement Published Assigned finding tags:
RAACMinter::getUtilizationRate incorrectly mixes stability pool deposits with lending pool debt index instead of using proper lending pool metrics
inallhonesty 4 months ago
Submission Judgement Published Assigned finding tags:
RAACMinter::getUtilizationRate incorrectly mixes stability pool deposits with lending pool debt index instead of using proper lending pool metrics
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.