Venus Protocol Isolated Pools - ast3ros's results

Lines of code

https://github.com/code-423n4/2023-05-venus/blob/b375407d58f71c18f398709d90409e53e94234e5/contracts/WhitePaperInterestRateModel.sol#L17

Vulnerability details

Impact

The baseRatePerBlock and multiplierPerBlock are significantly overestimated (by a factor of 5) and this results in wrong borrow and supply rates. This can mislead borrowers into paying much higher interest rates and facing higher risk of default.

Proof of Concept

The interest rate model assumes the following approximate number of blocks per year:

    uint256 public constant blocksPerYear = 2102400;

https://github.com/code-423n4/2023-05-venus/blob/b375407d58f71c18f398709d90409e53e94234e5/contracts/WhitePaperInterestRateModel.sol#L17

However, this number is based on the Ethereum average block time of 15 seconds. The Venus protocol is deployed on BSC and the block time is only 3 seconds, so the actual number of blocks per year should be much higher at 10512000.

Because the blocksPerYear is underestimated, it leads to 5 times higher baseRatePerBlock and multiplierPerBlock.

    baseRatePerBlock = baseRatePerYear / blocksPerYear;
    multiplierPerBlock = multiplierPerYear / blocksPerYear;

The borrow rate and supply rate are also significantly overestimated: Borrow rate:

    (ur * multiplierPerBlock) / BASE) + baseRatePerBlock

Supply rate:

    (utilizationRate(cash, borrows, reserves) * rateToPool) / BASE

Tools Used

Manual

Recommended Mitigation Steps

Change the blocksPerYear from 2102400 to 10512000.

-    uint256 public constant blocksPerYear = 2102400;
+    uint256 public constant blocksPerYear = 10512000;

Assessed type

Other