Kinetic Disclosed Report

https://github.com/kinetic-market/public-money-market-contracts

Code snippet

https://github.com/kinetic-market/public-money-market-contracts/blob/main/contracts/CTokenInterfaces.sol#L32

Description

The original borrowRateMaxMantissa is set to 0.0005e16, translating to a maximum borrow rate of 0.0005% per block. (This value was calculated assuming an average block time of 15 seconds.)

Since Flare now uses 1.8 - 3 second intervals, the unchanged borrowRateMaxMantissa permits a borrow rate that is 7,8 times higher than originally intended.

Root Cause

The borrowRateMaxMantissa ()

https://github.com/kinetic-market/public-money-market-contracts/blob/main/contracts/CTokenInterfaces.sol#L32 was not adjusted for the Flare chain, specifically the use of block.timestamp in place of block.number. As a result, it allows for borrow rates up to 7/8 times higher than designed.

Impact

Borrowers may experience borrow rates up to 7,8 times higher than those originally intended in Compound v2.

Mitigation

Adjust the borrowRateMaxMantissa to reflect the use of block.timestamp or acknowledge that this behavior is expected.

Refrences

• https://github.com/sherlock-audit/2024-12-mach-finance-judging/issues/25

• https://github.com/sherlock-audit/2024-12-numa-audit-judging/issues/192