Kinetic Disclosed Report

https://github.com/kinetic-market/public-money-market-contracts

Summary

The borrowRateMaxMantissa constant in the protocol is inherited from Compound v2 without adjustment for Flare network's ~1 second block time (compared to Ethereum's ~12 seconds), allowing significantly higher annualized borrow rates than intended.

Impact

While not an immediate security risk, using Compound's Ethereum-optimized borrowRateMaxMantissa on Flare results in a maximum annual borrow rate of ~15,768% versus Compound's ~1,314%. This could lead to protocol instability under high utilization scenarios.

Current implementation uses Compound's constant:

// Maximum borrow rate that can ever be applied (.0005% / block)
uint256 internal constant borrowRateMaxMantissa = 0.0005e16;

Calculations for maximum annual rates:

1. Compound (Ethereum, 12s blocks): Annual Rate = 0.0005% (31,536,000 / 12) ≈ 1,314%

2. Kinetic (Flare, 1s blocks): Annual Rate = 0.0005% 31,536,000 ≈ 15,768% This means our protocol allows for maximum borrow rates approximately 12x higher than Compound's intended maximum.

Recommendation

Adjust borrowRateMaxMantissa to account for Flare's faster block time:

// Adjusted for Flare's 1s block time to maintain similar economics to Compound
uint256 internal constant borrowRateMaxMantissa = 0.00004e16; // ~0.00004% per block