Return to site
Return to site

Bug Deep Dive #19

Borrow fee uses APY as per-second rate, causing extreme overcharging - $4432

· Bug Deep Dive
Section image

The borrow fee rate returned by the smooth rate curve is an annual percentage yield (APY), but the implementation multiplies it directly by elapsed seconds without annualizing. This treats an annual rate as if it were a per-second rate, inflating fees by roughly 31,536,000x over the intended amount. Borrowers are charged massive, unjustified fees even over short time intervals.

The function chargeTrueFeeRate in src/walkers/Fee.sol treats the APY returned by calculateRateX64 as a per-second rate by multiplying it by the elapsed seconds timeDiff without dividing by the number of seconds in a year. However, the rate returned by the curve is an annualized rate. The library documents that the seconds-per-year (SPR) factor is 31,536,000 and distinguishes APR vs SPR:

Section image

Therefore, the correct computation must divide by 365 days to convert the annual rate to a per-second rate before applying timeDiff.

Alpha: the code could have been correct if not for the comment saying what value the variable takes, since it is possible to set the return value to an annualized rate, so make sure to take this in consideration.

Conclusion

This finding would earn you $4432, and is actually quite tricky because you would need to check what value the calculateRateX64 function returns, either per second or total in a year.

Full Report
Codebase

Subscribe
Previous
Bug Deep Dive #18
Next
Bug Deep Dive #20
 Return to site
Cookie Use
We use cookies to improve browsing experience, security, and data collection. By accepting, you agree to the use of cookies for advertising and analytics. You can change your cookie settings at any time. Learn More
Accept all
Settings
Decline All
Cookie Settings
Necessary Cookies
These cookies enable core functionality such as security, network management, and accessibility. These cookies can’t be switched off.
Analytics Cookies
These cookies help us better understand how visitors interact with our website and help us discover errors.
Preferences Cookies
These cookies allow the website to remember choices you've made to provide enhanced functionality and personalization.
Save