Submission Details
Severity:
DebtToken::updateUsageIndex() can never be called
Description
Inside DebtToken.sol, the admin function updateUsageIndex() has a onlyReservePool modifier which restricts its call to be made only by the LendingPool contract and no one else.
File: contracts/core/tokens/DebtToken.sol
115: /**
116: * @notice Updates the usage index
117: * @param newUsageIndex The new usage index
118: */
119:@---> function updateUsageIndex(uint256 newUsageIndex) external override onlyReservePool {
120: if (newUsageIndex < _usageIndex) revert InvalidAmount();
121: _usageIndex = newUsageIndex;
122: emit UsageIndexUpdated(newUsageIndex);
123: }
However there is no function inside LendingPool.sol that calls the aforementioned function.
Impact
The functionality which DebtToken::updateUsageIndex() aims to provide can never be used. Admin would not be able to update the usage index.
Mitigation
Add a function inside LendingPool.sol which looks like:
function updateUsageIndex(uint256 newUsageIndex) external onlyOwner {
IDebtToken(reserve.reserveDebtTokenAddress).updateUsageIndex(newUsageIndex);
}
Updates
Lead Judging Commences
inallhonesty 4 months ago
Submission Judgement Published Reason: Non-acceptable severity
Assigned finding tags:
[INVALID] Unused _usageIndex Variable and updateUsageIndex() Function in DebtToken Contract
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.