Submission Details
Severity:
getutilization rate is not up to date because of use of stale values
Summary
getutilization rate is not up to date because of use of stale values because it doesn't update the normalized debt in lending pool.
Vulnerability Details
Following is how utlization rate is calcualted in raac minter
function getUtilizationRate() internal view returns (uint256) {
uint256 totalBorrowed = lendingPool.getNormalizedDebt();
uint256 totalDeposits = stabilityPool.getTotalDeposits();
if (totalDeposits == 0) return 0;
return (totalBorrowed * 100) / totalDeposits;
}
Now this getnormalizeddebt returns usage index which is not updated before calling this getnormalizedDebt call thus wrong utilzation rate will be returned.
Impact
Wrong utilization rate will be returned,
Tools Used
Manual
Recommendations
Update the usage inde before making this call.
Updates
Lead Judging Commences
inallhonesty 4 months ago
Submission Judgement Published Assigned finding tags:
LendingPool::getNormalizedIncome() and getNormalizedDebt() returns stale data without updating state first, causing RToken calculations to use outdated values
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.