Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Wrong Utilization Calculation in RAACMinter::getUtilizationRate()

opecon

Summary

The wrong utilization calculaton in RAACMinter::getUtilizationRate() will severly underestimate the utilization rate of the system which in turn will skew down the emmission rate disproportionately.

Vulnerability Details

The RAACMinter::getUtilizationRate() function when calculating the utilization rate wrongly returns the usageIndex instead of the totalDebt of the system:

/**
* @dev Calculates the current system utilization rate
* @return The utilization rate as a percentage (0-100)
*/
function getUtilizationRate() internal view returns (uint256) {
uint256 totalBorrowed = lendingPool.getNormalizedDebt(); // @audit usageIndex returned
uint256 totalDeposits = stabilityPool.getTotalDeposits();
if (totalDeposits == 0) return 0;
return (totalBorrowed * 100) / totalDeposits;
}
​

It then proceeds to use the wrong totalBorrowed amount to calculate the utilization rate of the system. The usageIndex is a much more smaller value compared to the total debt recorded so this formula will grossly underestimate the utilization rate which also affects the emmission rate.

Impact

The reduction of RAACToken emmisions would largely affect user RAAC rewards as the users would get much less RAAC rewards than intended

Tools Used

Manual Review

Recommendations

/**
* @dev Calculates the current system utilization rate
* @return The utilization rate as a percentage (0-100)
*/
function getUtilizationRate() internal view returns (uint256) {
```diff
- uint256 totalBorrowed = lendingPool.getNormalizedDebt();
+ uint256 totalBorrowed = lendingPool.debtToken.totalSupply();
```
uint256 totalDeposits = stabilityPool.getTotalDeposits();
if (totalDeposits == 0) return 0;
return (totalBorrowed * 100) / totalDeposits;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACMinter::getUtilizationRate incorrectly mixes stability pool deposits with lending pool debt index instead of using proper lending pool metrics

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACMinter::getUtilizationRate incorrectly mixes stability pool deposits with lending pool debt index instead of using proper lending pool metrics

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.