# Incorrect blocksPerYear constant in WhitepaperInterestRateModel

WhitePaperInterestRateModel kept Compound's 15s-block blocksPerYear constant on BNB Chain's 3s blocks, making borrow/supply rates 5x intended.

- Payout: Contest reward
- Severity: high
- Program: Venus Protocol
- Credited: Team\_Rocket
- Disclosed: 2023-08-09
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-05-venus-findings/issues/320
- Library page: https://bugbountylibrary.com/r/c4%3A2023-05-venus%3AH-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error

**Target:** WhitePaperInterestRateModel Solidity contract (interest rate model)
**Root cause:** blocksPerYear constant hardcoded to 2102400 (Ethereum 15s blocks) but deployed on BNB Chain with 3s blocks, so baseRatePerBlock and multiplierPerBlock are 5x too large.
**Steps:**
1. Read contracts/WhitePaperInterestRateModel.sol: blocksPerYear = 2102400.
2. Note Venus deploys on BNB Chain with ~3s block time.
3. Compute correct value: 365*24*3600/3 = 10512000.
4. Compare borrow rate curves for 2102400 vs 10512000 blocks/year; curves diverge 5x and never intersect.
**How found:** Code-reading of a Compound-forked interest rate model; noticed the hardcoded blocksPerYear assumes 15s blocks while target chain BNB has 3s blocks.
**Exploitation:** Not an attack; mispricing causes rates 5x intended, making pool highly sensitive to utilization and incentivizing arbitrageurs to deposit collateral to capture inflated supply rate, pushing utilization near 0.
**Insight:** When auditing forks deployed to a different chain, diff chain-specific constants (block time, blocksPerYear, secondsPerYear) against the new chain's actual parameters.