Core Contracts

Summary

As specified in the documentation, the lending pool is used "for getting system utilization data". The utilization rate of the lending pool corresponds to the proportion of deposited crvUSD that are actually borrowed by RAAC NFT holders.

Depending on this utilization rate, RAAC token emission is updated.

The problem arises because utilization rate computation is incorrect:

totalDeposits are retrieved using the stability pool and getTotalDeposit function which returns the total amount of RToken (yield-bearing token received when depositing crvUSD in the lending pool) deposited in the stability pool.

This is incorrect as all minted RTokens are not deposited in the stability pool. This will lead to incorrect computation of the new emission rate during each emission rate update.

Also, totalBorrowed is retrieved using lendingPool.getNormalizedDebt(). This is also incorrect as this function returns an index, not an amount of tokens. Note that lendingPool.getNormalizedDebt() is also incorrect as it doesn't normalize the index (see other issue).

Impact

The impact of this issue is medium as it leads to incorrect computation of the new emission rate.

Tools Used

Manual review

Recommendations

Make sure to correctly compute getUtilizationRate using the lending pool reserve values for both the total borrowed and the total deposits.