Core Contracts

Summary

The getUtilizationRate() function in the RAACMinter contract incorrectly uses getNormalizedDebt() to get the total borrowed amount, which returns the usage index instead of the total debt. This leads to an incorrect utilization rate calculation that affects the emission rate adjustments.

Vulnerability Details

The RAACMinter.getUtilizationRate() function uses:

contracts/core/minters/RAACMinter/RAACMinter.sol#L241

The issue is that getNormalizedDebt() returns the usage index rather than the actual total borrowed amount. Looking at LendingPool contract, the correct value should be reserve.totalUsage which represents the total debt in the system.

Impact

This issue causes incorrect utilization rate calculations which directly affects emission rate adjustments and RAAC Token distribution. Therefore, the impact is high as it fundamentally breaks the protocol's core rewards emission mechanism.

Tools Used

Manual code review

Recommendations

1. Add a view function in LendingPool to expose the total debt:

   function getTotalDebt() external view returns (uint256) {

   return reserve.totalUsage;

   }

2. Modify the getUtilizationRate() function to use the correct total debt value

   function getUtilizationRate() internal view returns (uint256) {

   uint256 totalUsage = lendingPool.getTotalDebt();

   uint256 totalDeposits = stabilityPool.getTotalDeposits();

   if (totalDeposits == 0) return 0;

   return (totalUsage * 100) / totalDeposits;

   }