Core Contracts

Summary

The deposit() function allows users to deposit an arbitrary amount of reserve assets, but there is no limit on how much a single user deposit in one transaction or cumulatively over time.

Vulnerability Details

• Since the protocol has a governance mechanism tied to RTokens, a large deposit could give a single user excessive influence over governance decisions (e.g., voting on interests rates or liquidation parameters).

• The protocol maintains a liquidity buffer ratio (e.g., 20% of total deposiits) to ensure enough liquidity is available for withdrawals and liquidations.

• A massive deposits could artificially increase total deposits, making the buffer inadequate for liquidations.

• This could leads to unintended liquidations or a protocol freeze if there’s not enough liquidity left for users to withdraw.

Impact

Governance manipulation (high impact if governance is decentralized)

Liquidity buffer Depletion

Tools Used

Manual Review

Recommendations

Implement a Maximum deposit per transaction or per users