Core Contracts

Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Submission Details
Severity: medium
Valid

`ReserveLibrary.getNormalizedDebt` Does Not Return Correct Normalized Debt

Summary

The ReserveLibrary.getNormalizedDebt function is intended to return the normalized debt of a reserve. However, it currently returns the usage index multiplied by a compounded interest value, which does not accurately reflect the total normalized debt. This miscalculation can lead to incorrect utilization rates and affect the overall financial calculations within the library.

Vulnerability Details

The getBorrowRate() and getLiquidityRate() functions rely on the getNormalizedDebt() function to retrieve the total normalized debt:

function getBorrowRate(ReserveData storage reserve, ReserveRateData storage rateData) internal view returns (uint256) {
uint256 totalDebt = getNormalizedDebt(reserve, rateData); // Retrieves normalized debt
uint256 utilizationRate = calculateUtilizationRate(reserve.totalLiquidity, totalDebt);
return calculateBorrowRate(rateData.primeRate, rateData.baseRate, rateData.optimalRate, rateData.maxRate, rateData.optimalUtilizationRate, utilizationRate);
}
function getLiquidityRate(ReserveData storage reserve, ReserveRateData storage rateData) internal view returns (uint256) {
uint256 totalDebt = getNormalizedDebt(reserve, rateData); // Retrieves normalized debt
uint256 utilizationRate = calculateUtilizationRate(reserve.totalLiquidity, totalDebt);
return calculateLiquidityRate(utilizationRate, rateData.currentUsageRate, rateData.protocolFeeRate, totalDebt);
}

However, the implementation of getNormalizedDebt() does not return the total normalized debt. Instead, it returns the current usage index multiplied by a compounded interest calculation:

function getNormalizedDebt(ReserveData storage reserve, ReserveRateData storage rateData) internal view returns (uint256) {
uint256 timeDelta = block.timestamp - uint256(reserve.lastUpdateTimestamp);
if (timeDelta < 1) {
return reserve.totalUsage;
}
return calculateCompoundedInterest(rateData.currentUsageRate, timeDelta).rayMul(reserve.usageIndex); // Incorrect calculation
}

Impact

The utilization rate, which is a critical factor in determining borrowing and liquidity rates, will be calculated based on an inaccurate total debt figure.

Tools Used

Manual Review

Recommendations

To correct the issue, the getNormalizedDebt() function should be modified to return the actual normalized debt by multiplying the total usage by the compounded usage index:

Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

getNormalizedDebt doesn't return total debt but only the index, causing incorrect utilization and interest rate calculations

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

getNormalizedDebt doesn't return total debt but only the index, causing incorrect utilization and interest rate calculations

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.