Part 2

Summary

The depositCreditForMarket function accepts deposits based on old vault states by not recalculating credit capacity beforehand.

Vulnerability Details

The function directly updates market state without recalculating vault credit capacities.

The function updates market state directly at lines 335-341 without first recalculating credit capacities, which can lead to incorrect credit delegation amounts since it relies on potentially outdated vault states.

Interestingly, withdrawUsdTokenFromMarket recalculates the credit capacity before updating the market state which is intentional.

Impact

The protocol uses stale debt values for critical calculations which results in incorrect credit delegation amounts and misaligned reward distributions.

Recommendations

Add a call to recalculateVaultsCreditCapacity at the beginning of depositCreditForMarket function to ensure credit capacity calculations use up-to-date vault states.