Core Contracts

Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Submission Details
Severity: low
Valid

Incorrect Emission Rate Calculation in RAACMinter Creates Liquidity Bootstrapping Risk with Zero Deposits

Summary

The emission rate calculation mechanism in RAACMinter.calculateNewEmissionRate contains inverted incentives when the stability pool is empty. This critical flaw causes the protocol to reduce emission rewards when it should maximize them to bootstrap initial liquidity, directly undermining the protocol's ability to attract early deposits. The miscalculation creates a self-reinforcing cycle that prevents proper market formation and violates fundamental tokenomics assumptions about reward distribution during critical launch phases.

Vulnerability Details

The emission rate calculation in function RAACMinter.calculateNewEmissionRate (RAACMinter.sol#L220-L235) contains inverted incentive logic when the stability pool has zero deposits. The vulnerability manifests in two key locations:

  1. Incorrect Utilization Rate Handling:
    When stabilityPool.getTotalDeposits returns 0, the utilization rate is forced to 0 as a division protection mechanism. This 0 value is then incorrectly interpreted as under-utilization (utilizationRate < utilizationTarget) in the emission rate calculation logic.

  2. Perverse Incentive Creation:
    The current implementation reduces emission rates when utilization rate is 0, creating a negative feedback loop:

  • No deposits → Lower emissions → Less incentive for initial deposits

  • This directly contradicts the protocol's need to bootstrap liquidity through higher initial emissions

contract RAACMinter is IRAACMinter, Ownable, ReentrancyGuard, Pausable, AccessControl {
function calculateNewEmissionRate() internal view returns (uint256) {
@> uint256 utilizationRate = getUtilizationRate();
uint256 adjustment = (emissionRate * adjustmentFactor) / 100;
if (utilizationRate > utilizationTarget) {
uint256 increasedRate = emissionRate + adjustment;
uint256 maxRate = increasedRate > benchmarkRate ? increasedRate : benchmarkRate;
return maxRate < maxEmissionRate ? maxRate : maxEmissionRate;
} else if (utilizationRate < utilizationTarget) {
uint256 decreasedRate = emissionRate > adjustment ? emissionRate - adjustment : 0;
uint256 minRate = decreasedRate < benchmarkRate ? decreasedRate : benchmarkRate;
return minRate > minEmissionRate ? minRate : minEmissionRate;
}
return emissionRate;
}
function getUtilizationRate() internal view returns (uint256) {
uint256 totalBorrowed = lendingPool.getNormalizedDebt();
uint256 totalDeposits = stabilityPool.getTotalDeposits();
@> if (totalDeposits == 0) return 0;
return (totalBorrowed * 100) / totalDeposits;
}
}

The flawed logic deviates from the intended economic model where:

  • Zero deposits should trigger maximum emission rates to incentivize initial liquidity providers

  • Non-zero deposits with zero borrows should maintain benchmark rates to preserve base incentives

This creates systemic risk during protocol launch phases and market initialization scenarios where the stability pool starts empty.

Impact

This vulnerability directly undermines the protocol's core economic mechanisms with two critical impacts:

  1. Protocol Bootstrapping Failure Risk
    The inverted incentives create a systemic barrier to initial liquidity formation. New markets/pools may never achieve critical mass as the emission reduction mechanism actively discourages early participation.

  2. Permanent Suboptimal Emissions
    Even after initial deposits are made, the miscalculation persists when borrows are zero (common in new markets). This maintains emissions below intended baseline levels, violating the protocol's tokenomics design.

  3. Financial Impact on Protocol Growth

    • slower liquidity accumulation during critical launch phases

    • reduction in early-stage TVL growth

    • Increased vulnerability to competitor protocols offering proper incentives

The vulnerability represents a fundamental failure in the protocol's incentive alignment mechanism, threatening its long-term viability and market competitiveness.

Tools Used

Manual Review

Recommendations

Implement targeted handling for zero-deposit and zero-borrow scenarios:

function calculateNewEmissionRate() internal view returns (uint256) {
uint256 utilizationRate = getUtilizationRate();
uint256 adjustment = (emissionRate * adjustmentFactor) / 100;
// Handle zero deposits scenario
if (stabilityPool.getTotalDeposits() == 0) {
return maxEmissionRate;
}
// Handle existing deposits but zero borrows
if (utilizationRate == 0) {
return benchmarkRate;
}
if (utilizationRate > utilizationTarget) {
uint256 increasedRate = emissionRate + adjustment;
uint256 maxRate = increasedRate > benchmarkRate ? increasedRate : benchmarkRate;
return maxRate < maxEmissionRate ? maxRate : maxEmissionRate;
} else if (utilizationRate < utilizationTarget) {
uint256 decreasedRate = emissionRate > adjustment ? emissionRate - adjustment : 0;
uint256 minRate = decreasedRate < benchmarkRate ? decreasedRate : benchmarkRate;
return minRate > minEmissionRate ? minRate : minEmissionRate;
}
return emissionRate;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACMinter incorrectly reduces emission rates on zero deposits, creating inverted bootstrapping incentives

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACMinter incorrectly reduces emission rates on zero deposits, creating inverted bootstrapping incentives

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.