Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Missing Index Updates in RToken and DebtToken Contracts

bshyuunn

01. Relevant GitHub Links

02. Summary

Certain index update functions (updateUsageIndex, updateLiquidityIndex) exist in the RToken and DebtToken contracts, but there is no ReservePool code that actually calls these functions. As a result, the index values remain unchanged, potentially causing confusion for anyone relying on these values off-chain.

03. Vulnerability Details

updateUsageIndex and updateLiquidityIndex can only be called by the ReservePool address, but the ReservePool contract does not include any function to update these indices. Although the RToken contract includes functions to read these values, they are never actually updated in practice.

/**
* @notice Updates the usage index
* @param newUsageIndex The new usage index
*/
function updateUsageIndex(uint256 newUsageIndex) external override onlyReservePool {
if (newUsageIndex < _usageIndex) revert InvalidAmount();
_usageIndex = newUsageIndex;
emit UsageIndexUpdated(newUsageIndex);
}
/**
* @notice Updates the liquidity index
* @param newLiquidityIndex The new liquidity index
*/
function updateLiquidityIndex(uint256 newLiquidityIndex) external override onlyReservePool {
if (newLiquidityIndex < _liquidityIndex) revert InvalidAmount();
_liquidityIndex = newLiquidityIndex;
emit LiquidityIndexUpdated(newLiquidityIndex);
}

In the current implementation, these index variables are not used in any calculation in the RToken or DebtToken contracts. They simply remain set to their default value.

04. Impact

  • Off-chain processes or UIs that rely on these index values can receive incorrect information.

  • Users may become confused if the displayed indices are never updated.

05. Tools Used

Manual Code Review and Foundry

07. Recommended Mitigation

Add functionality in the ReservePool contract to properly call updateUsageIndex and updateLiquidityIndex. Ensuring these values are updated will help prevent misinformation and confusion for anyone relying on the index data.

Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

[INVALID] Unused _usageIndex Variable and updateUsageIndex() Function in DebtToken Contract

RToken::updateLiquidityIndex() has onlyReservePool modifier but LendingPool never calls it, causing transferFrom() to use stale liquidity index values

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.