Skip to content

Latest commit

 

History

History
55 lines (35 loc) · 2 KB

044.md

File metadata and controls

55 lines (35 loc) · 2 KB

Fast Khaki Raccoon

High

Incorrect total assets available calculation leads to incorrect utilisation

Summary

Incorrect total assets available calculation leads to incorrect utilisation ratio

Root Cause

Upon adding interest in FraxlendPairCore, we have the following code:

uint256 _totalAssetsAvailable = _totalAssetAvailable(totalAsset, totalBorrow, true);
_prevUtilizationRate = _totalAssetsAvailable == 0 ? 0 : (UTIL_PREC * totalBorrow.amount) / _totalAssetsAvailable;

_totalAssetsAvailable is calculated using the following code:

return _totalAsset.totalAmount(address(externalAssetVault)) - _totalBorrow.amount;

This causes the calculation to be incorrect as _totalAssetsAvailable is already subtracted by the totalBorrow.amount used in the utilisation ratio calculation.

Another issue stemming from that is the fact that if the _totalAssetsAvailable are 0, thus all are borrowed (as we are subtracting the borrowed assets), we have a utilisation ratio of 0 which is completely incorrect, it should be 100%.

Internal Pre-conditions

No response

External Pre-conditions

No response

Attack Path

First scenario:

  1. The utilisation ratio goes from 0 to 100% in one borrow (completely possible and likely especially during early times of the vault)
  2. Upon interest being added next time, the previous utilisation ratio is set to 0 incorrectly (should be 100%)
  3. Then upon adding interest, we won't pass the threshold as we supposedly went from 0 to 0, interest won't accrue even though we have a utilisation ratio change of 100%

Second scenario:

  1. The total borrow amount is 60 and the total amount is 100
  2. The total available assets are thus 40, the calculation would be 1e18 * 60 / 40 = 1.5e18 which is 150%, completely incorrect

Impact

The utilization ratio is incorrect and is used in multiple checks, the results will be completely incorrect

PoC

No response

Mitigation

Use totalAsset.totalAmount(address(externalAssetVault)) instead