Summary
The ReserveLibrary contains error in its implementation of getNormalizedDebt function This function incorrectly calculate interest rates and return wrong values, which affects the entire protocol's interest rate model and economic calculations.
Vulnerability Details
The issue exists in ReserveLibrary.sol:
getNormalizedIncome incorrectly applies double scaling by multiplying the already scaled interest rate with the liquidity index again
* @notice Gets the normalized income of the reserve.
* @param reserve The reserve data.
* @return The normalized income (in RAY).
*/
function getNormalizedIncome(ReserveData storage reserve, ReserveRateData storage rateData) internal view returns (uint256) {
uint256 timeDelta = block.timestamp - uint256(reserve.lastUpdateTimestamp);
if (timeDelta < 1) {
return reserve.liquidityIndex;
}
return calculateLinearInterest(rateData.currentLiquidityRate, timeDelta, reserve.liquidityIndex).rayMul(reserve.liquidityIndex);
}
Proof of Concept
contract ReserveLibraryPoc is Test {
using WadRayMath for uint256;
using ReserveLibrary for ReserveLibrary.ReserveData;
using ReserveLibrary for ReserveLibrary.ReserveRateData;
ReserveLibrary.ReserveData reserve;
ReserveLibrary.ReserveRateData rateData;
function setUp() public {
reserve.liquidityIndex = 1.1e27;
reserve.usageIndex = 1.1e27;
reserve.lastUpdateTimestamp = uint40(block.timestamp);
rateData.currentLiquidityRate = 0.05e27;
}
function test_double_scaling_in_normalized_income() public {
vm.warp(block.timestamp + 365 days);
uint256 normalizedIncome = ReserveLibrary.getNormalizedIncome(reserve, rateData);
uint256 expectedIncome = ReserveLibrary.calculateLinearInterest(
rateData.currentLiquidityRate,
365 days,
reserve.liquidityIndex
);
assertEq(normalizedIncome, expectedIncome);
}
}
Running the test shows:
[FAIL] test_double_scaling_in_normalized_income()
Expected: 1050000000000000000000000000
Actual: 1155000000000000000000000000
Impact
Interest rates are incorrectly calculated (15.5% instead of 5% in the PoC)
Debt calculations are wrong, affecting liquidations
All users are affected by incorrect interest calculations
Tools Used
Recommendations
Remove double scaling from getNormalizedIncome
Fix getNormalizedDebt to return usageIndex
