Core Contracts

Summary

rayExp() function from WadRayMath library is less accurate the higher the exponent

Vulnerability Details

WadRayMath.rayExp() does not calculate `e^x` accurately. For low values of x the result can be considerably accurate, but the higher is x the less accurate is the result, leading to calculating wrong compounded interest.

For a exponent value of 4 the function returns 51806349206349206349206349202 (51.8e27), while the real result would be 54.59e27, which means an error of >5%.

Impact

rayExp() function fails to properly return the correct value of `e^x`, specially when x is high. This leads to wrongly computing debt when calculating borrowRate and liquidityRate, so that calculations are incorrectly made in the contract.

Tools Used

Remix, testing

Recommendations

Use the exp() function from a reliable library which returns the exact value (solady or PRBMath).