Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

reserve.usageIndex can be manipulatable leads to miscalculation of user debt.

pavankv

Summary

Vulnerability Details

reserve.usageIndex which is used to find user debt while repaying borrowed amount but here reserve.usageIndex act as multipler and it can be change by huge amount of providing liquidity/withdrawing liquidity to lending pool.

Below code snippet we can se how reserve.usageIndex deteremined

function updateReserveInterests(ReserveData storage reserve,ReserveRateData storage rateData) internal {
uint256 timeDelta = block.timestamp - uint256(reserve.lastUpdateTimestamp);
if (timeDelta < 1) {
return;
}
...
// Update usage index (debt index) using compounded interest
reserve.usageIndex = calculateUsageIndex(
rateData.currentUsageRate,
timeDelta,
reserve.usageIndex // last Index
);
​

In above code snippet rateData.currentUsageRate is used below we can see how it determined

function updateInterestRatesAndLiquidity(ReserveData storage reserve,ReserveRateData storage rateData,uint256 liquidityAdded,uint256 liquidityTaken) internal {
// Calculate utilization rate
uint256 utilizationRate = calculateUtilizationRate(reserve.totalLiquidity, reserve.totalUsage);
​
// Update current usage rate (borrow rate)
rateData.currentUsageRate = calculateBorrowRate(
rateData.primeRate,
rateData.baseRate,
rateData.optimalRate,
rateData.maxRate,
rateData.optimalUtilizationRate,
utilizationRate
);

In above code snippet we can see that utilizationRate is determined using totalLiquidity and total Usage it providing huge liquidity or withdrawing the liquidity leads to normal user ac will be land on liquidation or repay amount will huge than expected. Here reserve.usageIndex used as multipler in repaying , liqudation and withDrawNft here this activity can make user to repay more or force liquidation.

Impact

User can be forced to more amount than expected

Tools Used

Recommendations

Implement different mechanism to calculating the user debt while repay , withdraw NFT and Liquidation.

Code Snippet

https://github.com/Cyfrin/2025-02-raac/blob/main/contracts/libraries/pools/ReserveLibrary.sol#L214C1-L225C11

https://github.com/Cyfrin/2025-02-raac/blob/main/contracts/libraries/pools/ReserveLibrary.sol#L138C1-L140C1

Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACMinter's utilization rate calculation uses point-in-time values that can be manipulated via flash borrowing/lending, allowing control of emission rates at minimal cost

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACMinter's utilization rate calculation uses point-in-time values that can be manipulated via flash borrowing/lending, allowing control of emission rates at minimal cost

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.