Core Contracts

Summary

The DebtToken::updateUsageIndex function is intended to update _usageIndex, but it is never called in the codebase. This means _usageIndex remains static and serves no functional purpose. Furthermore, _usageIndex is not used in any other logic, making both the function and variable redundant.

Vulnerability Details

Problem description

• DebtToken::updateUsageIndex is designed to update _usageIndex and is restricted to calls from the reservePool, which is the LendingPool contract.

• The function is never invoked within the LendingPool, meaning _usageIndex is never updated.

• _usageIndex is not used anywhere else in the contract, making it an unused storage variable.

• The presence of an unused state variable increases storage costs without providing any functionality.

Affected Code in DebtToken

Steps to reproduce

1. Check for any function calls to updateUsageIndex within LendingPool.

2. Verify that _usageIndex is never used in other parts of the contract.

3. Confirm that _usageIndex remains uninitialized beyond its default value.

Impact

• Redundant storage usage: _usageIndex occupies storage without being used.

• Unnecessary complexity: The function updateUsageIndex exists but is never called, leading to confusion.

• Gas inefficiency: Unused storage variables increase contract deployment and execution costs.

Tools Used

Manual Review

Recommendations

1. If _usageIndex is necessary, ensure that updateUsageIndex is correctly invoked in LendingPool.

2. If _usageIndex serves no purpose, remove it and the associated function to reduce unnecessary complexity.