Summary

The MToken.getCash external function will return incorrect cash balance of the market until badDebt will be paid out. This can cause unexpected errors, gas and profit losses in integrated contracts since the MErc20DelegateFixer.getCashPrior function modification is performed in existing markets.

Vulnerability Details

The modification of getCashPrior internal function is necessary to prevent mTokens exchange rate changing during a manual user positions liquidation.

Enterally the getCashPrior function is used in the MToken for receiving the quantity of underlying asset owned by this market. But after the modification of the getCashPrior the MToken.getCashwill return incorrect information about the cash balance:

This function is used by other contracts in interactions with the market. Even the mipm17 contract uses the getCash function to get balance.

So external contracts expect to receive actual information about the cash balance of the market but for the modified markets they can receive incorrect value. This can cause unexpected errors, gas and profit losses while other contracts interact with the borrowing on modified markets for as example.

Impact

Unexpected errors, gas and profit losses due to broken integration.

Tools used

Manual Review

Recommendations

Consider overwriting the MToken.getCash function to receive the correct value.