Submission Details
Severity:
The flawed execution order in `ReserveLibrary::updateInterestRatesAndLiquidity` causes misalignment between indices and interest rates.
Summary
In the current implementation, updateReserveInterests is executed after calculateBorrowRate and calculateLiquidityRate, resulting in reserve interest calculations using post-updated rate values.
Impact
The computed reserve interests are mathematically invalid due to the above logical flaws.
Tools Used
Manual Review
Recommendations
Refactor as follows:
function updateInterestRatesAndLiquidity(ReserveData storage reserve,ReserveRateData storage rateData,uint256 liquidityAdded,uint256 liquidityTaken) internal {
// Update total liquidity
if (liquidityAdded > 0) {
reserve.totalLiquidity = reserve.totalLiquidity + liquidityAdded.toUint128();
}
if (liquidityTaken > 0) {
if (reserve.totalLiquidity < liquidityTaken) revert InsufficientLiquidity();
reserve.totalLiquidity = reserve.totalLiquidity - liquidityTaken.toUint128();
}
uint256 totalLiquidity = reserve.totalLiquidity;
uint256 totalDebt = reserve.totalUsage;
uint256 computedDebt = getNormalizedDebt(reserve, rateData);
uint256 computedLiquidity = getNormalizedIncome(reserve, rateData);
uint256 utilizationRate = calculateUtilizationRate(reserve.totalLiquidity, reserve.totalUsage);
+ updateReserveInterests(reserve, rateData);
rateData.currentUsageRate = calculateBorrowRate(
rateData.primeRate,
rateData.baseRate,
rateData.optimalRate,
rateData.maxRate,
rateData.optimalUtilizationRate,
utilizationRate
);
rateData.currentLiquidityRate = calculateLiquidityRate(
utilizationRate,
rateData.currentUsageRate,
rateData.protocolFeeRate,
totalDebt
);
- updateReserveInterests(reserve, rateData);
emit InterestRatesUpdated(rateData.currentLiquidityRate, rateData.currentUsageRate);
}
Updates
Lead Judging Commences
inallhonesty 4 months ago
Submission Judgement Published Assigned finding tags:
ReserveLibrary::updateInterestRatesAndLiquidity calls updateReserveInterests after state changes, causing indices to be updated too late and resulting in incorrect interest accrual
inallhonesty 4 months ago
Submission Judgement Published Assigned finding tags:
ReserveLibrary::updateInterestRatesAndLiquidity calls updateReserveInterests after state changes, causing indices to be updated too late and resulting in incorrect interest accrual
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.