Core Contracts

Summary

in LendingPool: A borrower can use flash loans to repeatedly reset the borrow rate to the minimum, preventing the protocol from accruing interest correctly. This is because the borrow rate update depends on time passing (at least 1 second).

Vulnerability Details

The ReserveLibrary.updateReserveInterest() function updates the usageIndex (which increases the borrow rate) only if the time elapsed since the last update is greater than or equal to 1 second (timeDelta < 1). This creates a vulnerability where a malicious borrower can exploit flash loans to manipulate the borrow rate:

Attack Scenario:

Attacker deploys a malicious contract to do all these functions in one transaction:

1- Flash Loan Initiation (t=0s): The attacker initiates a flash loan, borrowing a large amount of assets (crvUSD from curve FlashLender which has zero fee).

2- Deposit: The increased liquidity drives the utilizationRate down to near zero. A near-zero utilization rate causes the borrowRate to be set to its minimum value (minRate).

3- State Update: The attacker calls updateState() function that sets borrowIndex. The change in borrowIndex will be minimum because of the current (and artificially low) borrowRate.

4- Withdraw: The attacker withdraws the previously deposited assets. The borrowIndex remains at its minimum because the time delta (from previous update) is still less than 1 second.

5- Flash Loan Return: The attacker repays the flash loan.

6- Repeat (t=1s, 2s, etc.): The attacker repeats steps 1-5 every second. Since the flash loan transaction occurs within a single second, the usageIndex is never updated, keeping the borrowRate artificially low.

Note: When transactions (withdraw, deposite, etc) in LendinPool are very low, the borrowIndex will remain low for a longer time

Impact

By keeping the borrowRate at its minimum, the attacker avoids paying the correct amount of interest on their borrowed funds. This results in a loss of revenue for the protocol and its liquidity providers.

Tools Used

vscode

Recommendations

Remove Time Delta Check or Use max amount on deposits